Threat reportVulnerabilityTL-2026-3489
Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045, Crashpad CVE-2026-78952) built with GPT-5.6 Sol by XBOW earns $250,000 Google bounty
Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045 (TL-2026-3489), also tracked as Zero to Calc in Six Days, is a high-severity software vulnerability scored CVSS 8.3, first published 2026-10-14. It has no confirmed attribution, affects Google Chrome (Windows), references 2 CVEs (CVE-2026-85045, CVE-2026-78952), maps to 10 MITRE ATT&CK techniques (T1059.003, T1059.007, T1068), and is covered by 9 detection rules and 20 indicators of compromise.
- CVSS
- 8.3/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-3489
- Threat ID
- TL-2026-3489
- Also known as
- Zero to Calc in Six Days, XBOW Chrome Full Chain
- Severity
- HIGH
- CVSS
- 8.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
- Updates
- 2026-10-14 · 2 updates · revalidated 2× · latest source
Malware and tooling in Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045
Malware and tooling: gpt-5.6-sol
How Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045 works
XBOW researchers, working with OpenAI's gpt-5.6-sol model, built a Windows Chrome full-chain exploit in six days (about $40,000 of API compute) by chaining a V8 Maglev deoptimization bug, an animated-WebP decoder out-of-bounds write that escapes the V8 sandbox, and a Crashpad bug that escapes the renderer sandbox. Google fixed all three flaws and paid a $250,000 bounty; no in-the-wild exploitation has been reported.
XBOW published its write-up, 'Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain', on 2026-10-13. A human researcher directed OpenAI's publicly available gpt-5.6-sol model between 2026-08-02 and 2026-08-07 and spent roughly $40,000 in API costs. The result was a three-stage chain from a malicious web page to code execution outside Chrome's renderer sandbox on Windows. Google's Chrome VRP paid $250,000. Press coverage describes this as the first full-chain award under the April 2026 VRP rules and the first granted to an autonomous platform. XBOW estimates the affected population at about one billion Chrome-on-Windows users. All three bugs were reported through Google's official channels and are fixed. No exploitation of real users has been reported.
Stage 1, V8 Maglev (Chromium issue 547819997, V8 change 8255554; no CVE identified in the sources reviewed). Maglev reused a mutable boxed number (HeapNumber) during deoptimization, which broke the invariant that HeapNumber deduplication applies only to immutable HeapNumbers. The deoptimizer materialized one mutable object that was then shared across separate JavaScript values. The exploit used this to forge metadata for a Uint8Array and gain read/write access across the 4GB pointer-compression cage. This is the V8 heap cage, not the V8 sandbox.
Stage 2, animated WebP decoder (Chromium issue 548509153; Chromium changes 8266257 and 8352899). Press reporting maps this stage to CVE-2026-85045, which NCSC-NL's CSAF record describes as a V8 race condition (CWE-367, CVSS 7.5) fixed in Chrome 152.0.7977.82. The XBOW write-up does not state CVE IDs, so the mapping is taken from the XBOW press release. This is a time-of-check/time-of-use flaw. The decoder cached frame geometry from one image while reading bytes from a substituted image (via a transferred ArrayBuffer), producing a heap overflow. Modified WebP geometry and payload gave a single attacker-chosen 64-bit native write, which escapes the V8 sandbox. The chain then used a Wasm Code Pointer table base modification and an 'island-hopping' loader of 13 64-bit immediates in Liftoff-generated Wasm code, joined by short jumps (about 70 bytes), to redirect execution. The write-up says CFG and CET were partially circumvented through valid call sequences to existing functions.
Stage 3, Crashpad on Windows (Chromium issue 545820931; Chromium change 8267322; CVE-2026-78952, CWE-787, CVSS 8.3, fixed in Chrome 152.0.7977.65). Crashpad's retry logic after a failed memory read assumed the target was unchanged between the failed and retried read. A freeze-exempt renderer thread could flip page protections during snapshot creation and cause an oversized read and a 0xa8-byte buffer overflow. That overflow corrupted the vtable pointers and state fields of a live SnapshotMinidumpMemoryWriter. Redirecting the memory-read callback to FallbackUnhandledExceptionFilter ran `cmd /k calc.exe` outside the sandbox, which demonstrates arbitrary program launch.
Defenders should note the real risk: AI assistance sharply lowers the cost and time to build a browser full chain, and XBOW says defenders should plan accordingly. The sources provide no network or file IOCs and no in-the-wild activity. The IOC list below holds only behavioral and artifact indicators taken from the write-up. CVE-2026-85046 (V8 type confusion, exploited in the wild, Chrome 152.0.7977.82) is a separate bug reported by another researcher and is NOT part of this chain. The cvss_score and vector shown are those of the highest-rated component CVE (CVE-2026-78952), not a rating of the chain. XBOW's V8 bug has no CVE in the reviewed sources. The mitigations are in Chrome 152.0.7977.65 and later: V8 now blocks HeapNumber deduplication during deoptimization, the WebP decoder validates stride/size against actual bitmap dimensions, and Crashpad clamps the retry length to the minimum of the page remainder and the original request size. Exploit code release was not confirmed in the sources.
MITRE ATT&CK techniques used in TL-2026-3489
Execution
T1059.003 Windows Command Shell; T1059.007 JavaScript; T1106 Native API; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
Defense Evasion
T1211 Exploitation for Defense Evasion; T1620 Reflective Code Loading
Resource Development
Affected products and versions in Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045
- Google — Chrome (Windows)
Vulnerable versions: prior to 152.0.7977.65 (Crashpad CVE-2026-78952); prior to 152.0.7977.82 (V8/WebP CVE-2026-85045)
Fixed in: 152.0.7977.82 and later - Microsoft — Edge (Chromium)
Vulnerable versions: prior to 152.0.4191.65 (CVE-2026-85045)
Fixed in: 152.0.4191.65 and later - Debian — Chromium
Vulnerable versions: prior to 152.0.7977.82-1~deb12u1 (CVE-2026-85045)
Fixed in: 152.0.7977.82-1~deb12u1
Remediation for Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045
Patches
- Chrome 152.0.7977.65 (CVE-2026-78952, Crashpad)
- Chrome 152.0.7977.82 (CVE-2026-85045 and later fixes)
- Microsoft Edge 152.0.4191.65
- Debian Chromium 152.0.7977.82-1~deb12u1
Immediate actions
- Update Google Chrome on Windows to 152.0.7977.82 or later (Crashpad fix landed in 152.0.7977.65) and relaunch the browser so the update takes effect
- Update Microsoft Edge to 152.0.4191.65 or later and other Chromium-based browsers to their equivalent fixed builds
- Verify browser version compliance across the Windows fleet with endpoint management tooling
Workarounds
- No vendor workaround documented; apply the patched browser builds
Longer-term hardening
- Treat AI-assisted exploit development as lowering the cost of browser full chains and shorten browser patch SLAs accordingly
- Monitor crashpad_handler.exe for child process creation or unexpected module loads
- Enable enterprise browser auto-update and enforce relaunch deadlines
CVEs associated with Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045
Weaknesses (CWE) in Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045
Timeline of Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045
- Challenge to build a Chrome full chain set at an XBOW Malta staff meeting (January 2026; exact day not stated, date is a month placeholder)
- Google's new Chrome VRP rules take effect (April 2026; exact day not stated, date is a month placeholder); XBOW's payout is the first full-chain payout under them.
- XBOW completes a first full Chrome exploit chain after roughly two months of work (June 2026; exact day not stated, date is a month placeholder); the Google-awarded chain was a later, separate build
- XBOW researcher begins building the Chrome full-chain exploit with gpt-5.6-sol (Sunday)
- XBOW's initial Gin-based V8 sandbox escape stage collided with a duplicate report (Chromium issue 542670566) and was replaced within hours by the animated-WebP stage; Google confirmed the chain.
- Six-day development window ends (Friday); chain demonstrated launching calc.exe outside the renderer sandbox on Windows, at about $40,000 in API cost
- CVE-2026-78952 (Crashpad out-of-bounds write, CVSS 8.3) published; fixed in Chrome 152.0.7977.65
- CVE-2026-85045 (V8 race condition / TOCTOU, CVSS 7.5) initially released; fixed in Chrome 152.0.7977.82 and Edge 152.0.4191.65
- XBOW publishes 'Zero to Calc in Six Days' and announces the $250,000 Chrome VRP reward, the first full-chain award under the 2026 rules
- Cyber Security News and other outlets report that all three flaws are fixed and no real-world exploitation is confirmed
Update history for TL-2026-3489
- 2026-10-14 — AI-Assisted Chrome Full-Chain Exploit (Maglev, WebCodecs ImageDecoder, Crashpad) Enabling Windows Code Execution - Google Pays $250,000: What changed No severity, exploitability, status or CVSS change; both records are HIGH / POC_PUBLIC / PATCHED. The update adds technical detail only. New indicators (12) 12 new behavioral, technique and entity indicators: the calc.exe PoC p
- 2026-10-14 — XBOW chains three Chrome zero-days (CVE-2026-85045, CVE-2026-78952, Animated-WebP) into full-chain Windows RCE exploit built with a public OpenAI model: What changed No field changes. Severity HIGH, exploitability POC_PUBLIC and status PATCHED are unchanged. New indicators (4) crashpad_handler.exe filename, the behavioral indicator of Crashpad handler child processes, and two XBOW people na
Sources cited for Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045
- Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain
- XBOW Rewarded for Exploit Affecting a Billion Users (press release)
- Google Awarded a $250,000 Bounty for a Full-chain Chrome Exploit Found Using GPT-5.6
- XBOW earns Google's $250,000 bounty with a six-day Chrome exploit
- It Cost $40,000 To Find A Google Chrome Zero-Day Bug With AI (Forbes)
- CVE-2026-85045 - NCSC-NL CSAF advisory (V8 race condition)
- CVE-2026-78952 - Crashpad out-of-bounds write (SentinelOne VDB)
- CVE-2026-78952 - Debian Security Tracker
- XBOW uses OpenAI's GPT-5.6 to exploit Chrome, earns $250,000 bounty
Detection coverage for TL-2026-3489
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3489 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.