News
XBOW uses GPT-5.6 to discover Chrome vulnerabilities and earns $250,000 bounty
Autonomous security firm XBOW combined OpenAI's GPT-5.6 Sol model with human researchers to uncover three previously unknown flaws in Google Chrome. The bugs—one in the V8 Maglev compiler, a WebP image decoder issue (CVE-2026-85045), and a Crashpad memory safety problem—were chained into a full‑chain exploit that could escape Chrome's sandbox on Windows. Google awarded XBOW the program's maximum $250,000 bounty, the first full‑chain reward in 2026 and only the second ever. The six‑day campaign ran from August 2 to August 7, 2026, and the findings were disclosed on October 13, 2026, after Google patched the vulnerabilities.