Xbow spent $40K on AI and cracked Google Chrome wide open
Xbow used a public OpenAI model to chain Chrome sandbox escapes, earning a $250,000 Google bounty.
74
- Mentions · 7d0
- Mentions · 30d3
- All mentions7
- First seenAug 13, 2026
- Last mentioned26d ago
Timeline
7 articles · newest firstSecurity researchers spent 6 days doing their Chromework, built 1B user exploit
Xbow chained three Chrome zero-days with GPT-5.6 Sol into a Windows sandbox escape affecting about one billion users.
88
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
XBOW researchers used GPT-5.6 Sol to chain three Chrome bugs into remote code execution, now patched.
76
Decepticon – Autonomous Red Team Agent that Integrates Claude and Codex
Open-source Decepticon red team agent links Claude Code and Codex to a LangGraph runtime for scoped attack-path testing.
44
AI Agent Finds Linux Kernel Bug That Turns a Tiny Memory Write Into Root Access
XBOW disclosed CVE-2026-72018, a Linux kernel DIBS flaw that turns a 16-byte zero write into local root.
67
Linux Kernel CVE-2026-72018 Flaw Lets Local Attackers Gain Root Access
CVE-2026-72018 lets local CAP_NET_ADMIN users escalate to root through a Linux SMC-D out-of-bounds write.
66
AI’s ‘middle class’ has gotten dramatically better at hacking
XBOW research shows mid-tier AI models now match frontier hacking capability at lower cost, raising concerns about widespread malicious offensive AI use.
52
Related CVEs
by mentions- CVE-2026-72018<1%7.8Linux kernel: dibs: loopback: validate offset and size in move_data()
- CVE-2026-78952<1%8.3Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to…
- CVE-2026-85045<1%7.5Race condition in Google Chrome V8 allows sandboxed code execution via crafted web page
Appears with
- OpenAIvendor · 5
- Googlevendor · 3
- Chromeproduct · 3
- Linux kernelproduct · 2
- OpenAIorganization · 2
- GPT-5.6 Solai model · 2
- Anthropicvendor · 2
- Red Hatorganization · 1
- IBMorganization · 1
- Mythos Previewproduct · 1
- Windowsproduct · 1
- Mythos Previewai model · 1
- GPT-5.5ai model · 1
- GPT-5.5product · 1
- SMC-Dproduct · 1
- Anthropicorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.