XBOW Builds a Chrome Full Chain in Six Days and Wins a $250,000 Reward
Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain
XBOW used AI agents running OpenAI's gpt-5.6-sol to build a Chrome full-chain exploit in six days, combining a V8 Maglev deoptimization bug, an animated-WebP TOCTOU flaw, and a Crashpad memory-safety bug. The chain crossed both the V8 and renderer sandboxes, achieving code execution outside the browser. Google awarded the first $250,000 Chrome full-chain reward under its April 2026 VRP rules. API costs for the six-day campaign were roughly $40,000.
Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days.
- ollin
This is a technical companion post to https://xbow.com/blog/xbow-built-a-chrome-full-chain-exploit
- creata
Off-topic*: Can I even visit untrusted websites anymore? Firefox's security is probably far worse than Chrome's, and escaping the browser sandbox now seems accessible to way too many people.
* Kind of on-topic given the last sentence of the article...
- whiplash25
Anyone else confused with the timeline? Is it actually no bugs to working full chain in 6 days?
1. CEO announces goal in January.
2. Team took 2 months on first working full chain.
3. In August, they swap out 1 bug in the chain with a new one, weaponize in 6 days. Weaponization of 1 bug costs $40K in 5.6 sol token spend.
Is that it?