Security firm XBOW utilized the GPT-5.6 Sol model from OpenAI to identify and exploit three previously unknown vulnerabilities in Google Chrome. The research team, led by CEO Oege de Moor and researcher Brendan Dolan-Gavitt, completed the full-chain exploit in six days between August 2 and August 7, 2026.
The exploit chain combined a bug in the V8 Maglev compiler, a flaw in the WebP image decoder (CVE-2026-85045), and a memory safety issue in Crashpad. This sequence allowed for unsandboxed code execution on Windows systems, potentially impacting approximately 1 billion users.
Google awarded XBOW a bounty of $250 000, the maximum payout under the company's revised program rules introduced in April 2026. This marks the first full-chain bounty awarded in 2026 and only the second in the history of the program.
The compute costs for the six-day project amounted to approximately $40 000 in API fees. The company publicly disclosed the findings on October 13, 2026, following the patching of all three vulnerabilities by Google.
