# Full-chain Chrome exploit (V8 Maglev, WebP CVE-2026-85045, Crashpad CVE-2026-78952) built with GPT-5.6 Sol by XBOW earns $250,000 Google bounty

> XBOW researchers, working with OpenAI's gpt-5.6-sol model, built a Windows Chrome full-chain exploit in six days (about $40,000 of API compute) by chaining a V8 Maglev deoptimization bug, an animated-WebP decoder out-of-bounds write that escapes the V8 sandbox, and a Crashpad bug that escapes the renderer sandbox. Google fixed all three flaws and paid a $250,000 bounty; no in-the-wild exploitation has been reported.

- **Published:** 2026-10-14T09:54:28Z
- **Last reviewed:** 2026-10-14T12:24:19.074Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3489
- **ID:** TL-2026-3489
- **Severity:** HIGH (CVSS 8.3)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-85045, CVE-2026-78952

## Description

XBOW published its write-up, 'Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain', on 2026-10-13. A human researcher directed OpenAI's publicly available gpt-5.6-sol model between 2026-08-02 and 2026-08-07 and spent roughly $40,000 in API costs. The result was a three-stage chain from a malicious web page to code execution outside Chrome's renderer sandbox on Windows. Google's Chrome VRP paid $250,000. Press coverage describes this as the first full-chain award under the April 2026 VRP rules and the first granted to an autonomous platform. XBOW estimates the affected population at about one billion Chrome-on-Windows users. All three bugs were reported through Google's official channels and are fixed. No exploitation of real users has been reported.

Stage 1, V8 Maglev (Chromium issue 547819997, V8 change 8255554; no CVE identified in the sources reviewed). Maglev reused a mutable boxed number (HeapNumber) during deoptimization, which broke the invariant that HeapNumber deduplication applies only to immutable HeapNumbers. The deoptimizer materialized one mutable object that was then shared across separate JavaScript values. The exploit used this to forge metadata for a Uint8Array and gain read/write access across the 4GB pointer-compression cage. This is the V8 heap cage, not the V8 sandbox.

Stage 2, animated WebP decoder (Chromium issue 548509153; Chromium changes 8266257 and 8352899). Press reporting maps this stage to CVE-2026-85045, which NCSC-NL's CSAF record describes as a V8 race condition (CWE-367, CVSS 7.5) fixed in Chrome 152.0.7977.82. The XBOW write-up does not state CVE IDs, so the mapping is taken from the XBOW press release. This is a time-of-check/time-of-use flaw. The decoder cached frame geometry from one image while reading bytes from a substituted image (via a transferred ArrayBuffer), producing a heap overflow. Modified WebP geometry and payload gave a single attacker-chosen 64-bit native write, which escapes the V8 sandbox. The chain then used a Wasm Code Pointer table base modification and an 'island-hopping' loader of 13 64-bit immediates in Liftoff-generated Wasm code, joined by short jumps (about 70 bytes), to redirect execution. The write-up says CFG and CET were partially circumvented through valid call sequences to existing functions.

Stage 3, Crashpad on Windows (Chromium issue 545820931; Chromium change 8267322; CVE-2026-78952, CWE-787, CVSS 8.3, fixed in Chrome 152.0.7977.65). Crashpad's retry logic after a failed memory read assumed the target was unchanged between the failed and retried read. A freeze-exempt renderer thread could flip page protections during snapshot creation and cause an oversized read and a 0xa8-byte buffer overflow. That overflow corrupted the vtable pointers and state fields of a live SnapshotMinidumpMemoryWriter. Redirecting the memory-read callback to FallbackUnhandledExceptionFilter ran `cmd /k calc.exe` outside the sandbox, which demonstrates arbitrary program launch.

Defenders should note the real risk: AI assistance sharply lowers the cost and time to build a browser full chain, and XBOW says defenders should plan accordingly. The sources provide no network or file IOCs and no in-the-wild activity. The IOC list below holds only behavioral and artifact indicators taken from the write-up. CVE-2026-85046 (V8 type confusion, exploited in the wild, Chrome 152.0.7977.82) is a separate bug reported by another researcher and is NOT part of this chain. The cvss_score and vector shown are those of the highest-rated component CVE (CVE-2026-78952), not a rating of the chain. XBOW's V8 bug has no CVE in the reviewed sources. The mitigations are in Chrome 152.0.7977.65 and later: V8 now blocks HeapNumber deduplication during deoptimization, the WebP decoder validates stride/size against actual bitmap dimensions, and Crashpad clamps the retry length to the minimum of the page remainder and the original request size. Exploit code release was not confirmed in the sources.

## MITRE ATT&CK

- T1587.004 Exploits
- T1588.007 Artificial Intelligence
- T1203 Exploitation for Client Execution
- T1059.007 JavaScript
- T1059.003 Windows Command Shell
- T1189 Drive-by Compromise
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Defense Evasion
- T1106 Native API
- T1620 Reflective Code Loading

## Sources

- [Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain](https://xbow.com/labs/research/zero-to-calc-in-six-days-inside-xbow-chrome-full-chain)
- [XBOW Rewarded for Exploit Affecting a Billion Users (press release)](https://www.financialcontent.com/article/bizwire-2026-10-13-xbow-rewarded-for-exploit-affecting-a-billion-users)
- [Google Awarded a $250,000 Bounty for a Full-chain Chrome Exploit Found Using GPT-5.6](https://cybersecuritynews.com/google-chrome-exploit-gpt-5-6/)
- [XBOW earns Google's $250,000 bounty with a six-day Chrome exploit](https://runtimewire.com/article/xbow-six-day-chrome-exploit-google-bounty)
- [It Cost $40,000 To Find A Google Chrome Zero-Day Bug With AI (Forbes)](https://www.forbes.com/sites/the-wiretap/2026/10/13/how-an-off-the-shelf-openai-model-found-three-google-chrome-zero-days/)
- [CVE-2026-85045 - NCSC-NL CSAF advisory (V8 race condition)](https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85045.json)
- [CVE-2026-78952 - Crashpad out-of-bounds write (SentinelOne VDB)](https://www.sentinelone.com/vulnerability-database/cve-2026-78952/)
- [CVE-2026-78952 - Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2026-78952)
- [XBOW uses OpenAI's GPT-5.6 to exploit Chrome, earns $250,000 bounty](https://cryptobriefing.com/xbow-gpt-5-6-chrome-exploit-bounty/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3489