Cybersecurity researchers at XBOW have developed a powerful exploit targeting Google Chrome on Windows in just six days, with help from a publicly available OpenAI AI model. The team received a $250,000 reward from Google for discovering and reporting the vulnerabilities. The achievement highlights how artificial intelligence is changing cybersecurity research and helping experts identify serious security weaknesses much faster than before.

The research team combined three previously unknown vulnerabilities to create a complete attack chain. This type of attack uses multiple security flaws together to bypass a system’s different layers of protection. According to XBOW, the exploit could allow an attacker to run code outside Chrome’s security sandbox simply by getting a user to load a specially designed webpage. No additional clicks or downloads were required for the demonstrated attack.

The exploit targeted three different components of Chrome’s security system. The first vulnerability affected V8, Chrome’s JavaScript engine, allowing control of memory inside its sandbox. The second flaw was found in the browser’s animated WebP image decoder and helped the researchers escape that protected environment. The third vulnerability affected Crashpad, Chrome’s crash-handling system, and helped achieve code execution outside the browser’s sandbox.

XBOW reported that its researchers worked with OpenAI’s publicly available GPT-5.6 Sol models to complete the exploit. The AI agents helped examine Chrome’s source code, test possible weaknesses, develop proof-of-concept code and prepare early versions of the exploit. Human researchers remained responsible for setting the research direction, checking the AI’s results and making important decisions throughout the process. The company reported spending approximately $40,000 on computing resources during the six-day effort.

Google confirmed the vulnerabilities and fixed them, according to XBOW’s announcement. The company also awarded XBOW $250,000 through its Chrome Vulnerability Reward Program, marking the first full-chain Chrome award under its 2026 rules. XBOW stated that the vulnerabilities were not used to attack Chrome users. The findings demonstrate why responsible vulnerability reporting and timely security updates are important for protecting widely used software.

This development raises important questions about the future of cybersecurity. AI can help security professionals discover complex vulnerabilities faster, but similar capabilities could also create risks if misused by attackers. XBOW believes that the time and cost required to find serious security flaws are decreasing. For users, keeping Chrome updated and restarting the browser after updates remain important security steps. The research shows how collaboration between human experts and AI could strengthen cybersecurity while making rapid vulnerability fixes increasingly important.

Stay alert, and keep your security measures updated!

Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news