XBOW Rewarded for Exploit Affecting a Billion Users

XBOW , the autonomous offensive security company, today announced that its platform has earned a $250,000 reward from Google's Chrome Vulnerability Reward Program. This is the first full‑chain Chrome award under Google's 2026 rules, and the first such award granted to an autonomous offensive security platform. The effort combined XBOW’s decades of offensive security experience with the capabilities of OpenAI’s GPT-5.6 Sol models.

Over six days, XBOW's AI agents and one security researcher worked together to build a complete Chrome exploit for Windows. The exploit chained three separate, previously unknown bugs into a single attack that ran code outside Chrome's security sandbox, the strongest barrier the browser has. With this access, an attacker could install malware, ransomware, or spyware; gain a foothold for lateral movement; or steal credentials or files. All of this without the need for a user to download or click anything.

Before the fixes, this class of flaw sat in the path of an estimated one billion people running Chrome on Windows globally.

“This disclosure highlights the speed and what is possible when human ingenuity and decades of offensive security experience is combined with the world’s most capable models. Separate, perhaps even low-severity, vulnerabilities can now be chained together into a high-severity exploit path,” said Oege de Moor, founder and CEO of XBOW. “It only took an estimated $40,000 of compute and six days for a single researcher to produce a chain that previously would have taken months. Attackers are working with this speed and ease, and defenders need a similar pace to find the exploitable paths among their many findings.”

XBOW reported every bug to Google through its official program, and Google's engineers reproduced the exploit, confirmed it, and shipped fixes. Public root‑cause reports for all three bugs are available, and the vulnerabilities were never used against Chrome users. XBOW will be using the award money to fund its continued efforts to secure NGOs using XBOW’s technology.

“We want to help more defenders find and fix critical vulnerabilities faster,” said Clint Gibler, Head of Cyber Research at OpenAI. “A single XBOW researcher used our models to uncover a chain of vulnerabilities that Google has now fixed. We’re working with security researchers and industry partners to put these capabilities in more defenders’ hands to protect the software people rely on every day.”

How the attack worked: The chain crossed two sandbox boundaries in three stages:

• A bug in V8, Chrome's JavaScript engine, gave the attacker control of memory inside the engine's sandbox.
• A bug in Chrome's animated‑WebP image decoder (CVE-2026-85045) broke out of that sandbox, producing a single precise write to native memory.
• A bug in Crashpad (CVE-2026-78952), Chrome's crash handler — which runs outside the sandbox — turned that into full code execution.

The result: a program launched outside Chrome's sandbox, triggered by nothing more than loading a web page. In a real attack, that program could be anything the attacker chose.

XBOW builds an autonomous offensive security platform that finds and proves exploitable vulnerabilities the way a real attacker would, then reports them so they can be fixed.

About XBOW

XBOW is the autonomous offensive security company redefining cyber defense for the AI era. Combining AI reasoning with offensive security workflows, the XBOW platform delivers expert-level security testing at machine speed. XBOW empowers security teams to transform from reactive to proactive defense at AI scale. For XBOW customers, autonomous offense is the best defense.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261009160376/en/

Contact

Media contact

Inkhouse for XBOW

xbow@inkhouse.com

© 2026 Business Wire, Inc.