XBOW Earns $250,000 Google Bounty for Chrome Exploit

XBOW received a $250,000 Google bounty after a six-day effort chained three previously unknown Chrome vulnerabilities on Windows to run code outside the browser’s sandbox.

The exploit started with a flaw in V8, Chrome’s JavaScript engine, crossed the sandbox through the animated WebP image decoder and used a Crashpad vulnerability to reach code execution beyond the browser’s protections.

The vulnerabilities could have affected an estimated 1 billion Chrome users on Windows before Google fixed them. XBOW submitted the findings through Google’s vulnerability reward program, and the exploit was never used against Chrome users.

XBOW’s effort paired AI agents with one human security researcher. XBOW founder and CEO Oege de Moor said separate vulnerabilities, including ones that may appear low severity individually, can combine into a high-severity exploit path. De Moor estimated the work took six days, compared with the months such a chain would previously have required.

XBOW estimated the effort used about $40,000 in computing resources, without providing a breakdown. The case suggests AI tools may help researchers connect flaws across browser components, but it does not establish how much the tools shorten development timelines in other cases.