AI Builds Complete Chrome Attack Chain in Six Days: Vulnerability Discovery Enters the Automation Era

Researchers at security firm XBOW used publicly available AI models to chain together three previously unknown Chrome vulnerabilities into a working, complete attack chain in just six days. This means that simply by opening a webpage, a Windows computer could be implanted with and execute code — no clicks, no downloads required. Google confirmed all three vulnerabilities, completed fixes, and paid out a maximum-tier bug bounty of $250,000. According to XBOW, the attack was never used against real users before the fix.

Six Days to Accomplish What Used to Take Months

The sprint phase of this attack was completed between August 2 and 7, but XBOW emphasizes that the team had months of preparation and testing as groundwork beforehand. The actual cost of the AI models used during those six days was approximately $40,000.

The tasks AI took on included: searching browser source code, validating attack ideas, building prototypes, and drafting preliminary reports. Human researchers were responsible for selecting targets, providing direction, and guiding the process. In other words, AI was not an autonomous hacker, but a high-intensity executor steered by human experts.

NYU researcher Brendan Dolan-Gavitt commented that this type of process used to take months and has now been compressed into six days. This time comparison itself is a signal: the pace of vulnerability discovery is being redefined by AI.

Three Vulnerabilities Distributed Across Different Chrome Modules

The difficulty of this attack chain lies not in how severe any single vulnerability is, but in stitching together three unrelated flaws into a coherent exploitation path. The three issues were located in:

• The code execution engine, the core module responsible for translating scripts into machine instructions;
• The image reading module, the channel that handles webpage image parsing;
• The error handling system, the logic used to catch and manage exception flows.

Google confirmed each of these three issues and completed fixes. The error handling-related issue was fixed in version 152.0.7977.65 on August 25, the code execution engine issue was fixed in version 152.0.7977.82 on September 3, and the image reading issue was also resolved within the 152 version update cycle.

Google also noted that before the patches were released, these vulnerabilities put approximately one billion Chrome users on Windows at risk. This scale is precisely why the complete attack chain was rated at the maximum bounty tier.

Renderer Process and Sandbox: Chrome uses a multi-process architecture, where webpage content runs in a low-privilege "renderer process" isolated by the operating system sandbox. The renderer process handles parsing HTML, executing JavaScript, decoding images, and more. Once compromised, the attacker only gains limited privileges. To actually execute arbitrary code on Windows, an attack chain typically needs to first gain read/write capability through a renderer vulnerability, then use a second vulnerability to bypass the sandbox (or escape to a higher-privilege browser process), and finally achieve code execution. The three flaws described in the article fall respectively in the code execution engine, image parsing, and error handling modules — precisely the typical "renderer entry + privilege escalation/escape" combination, which is why the complete attack chain was rated by Google at the maximum bounty tier.

What AI-Assisted Vulnerability Discovery Is Changing

The most noteworthy aspect of this incident is not any specific vulnerability, but the shift in how work is done. Traditional vulnerability research relies heavily on researchers' long-term accumulated intuition about code — a person might spend months understanding a module, then months more finding an exploitable flaw. The intervention of AI agent workflows has parallelized much of the repetitive labor along the chain of "read code — form hypotheses — validate — write drafts."

However, the cost structure remains clear: $40,000 in model API fees, plus months of team preparation and expert guidance. This is not zero-barrier automated attacking, but an amplification tool. What it amplifies is still the judgment of human researchers — choose the wrong target direction, and AI will only hit the wall faster.

For defenders, the situation has become more urgent. When the assembly time for an attack chain shrinks from months to six days, vendors' response windows are compressed in tandem. Google's performance in this incident was relatively efficient: confirmation, fixes, and staged rollout all completed within the 152 version cycle — but whether this can become the norm depends on whether bug bounty and response processes can keep up with AI-driven discovery speed.

For ordinary Chrome users, the most direct action remains keeping automatic browser updates enabled. Patches have already been distributed in version 152, and unpatched devices remain exposed to known risks.

Bug Bounty Tiers: Google's Chrome Vulnerability Reward Program (VRP) prices bounties by vulnerability severity, exploitation difficulty, and scope of impact. The highest tier typically requires a working, complete exploit chain — especially in cases where remote code execution can be achieved without user interaction — with bounties reaching up to $250,000 or even higher. Ordinary memory safety flaws that can only cause crashes or information leaks often command bounties in the thousands to tens of thousands of dollars. XBOW receiving the maximum tier indicates that Google not only confirmed three independent vulnerabilities, but also recognized the completeness and real-world severity of chaining them into an end-to-end attack chain.

The Next Step in Automated Attack and Defense

The XBOW case demonstrates that publicly available AI models are already sufficient, under expert guidance, to conduct high-quality vulnerability research. This both reduces the talent bottleneck for elite security teams and dramatically shortens the time gap between "vulnerability discovery" and "weaponization."

The next thing to watch is: whether defenders will similarly introduce AI at scale to automate patch validation and attack surface reduction, and how the bug bounty system will price AI-assisted discovery. The $250,000 maximum-tier bounty may be the market's first answer.

AI Agent Workflows: The "agent workflow" mentioned here refers to connecting large models with external tools, code execution environments, and browser instances, enabling the model to autonomously complete the closed loop of "reading source code — forming hypotheses — writing PoC — running validation — iterating based on error messages." Unlike simply using a model to generate text, agents call compilers, debuggers, and testing frameworks, converting natural language reasoning into executable actions. XBOW's approach was precisely to use this kind of workflow to explore a large number of attack hypotheses in parallel, then have human experts filter the direction. It is not mysterious — the core remains the combination of model capability, tool interfaces, and human guidance, simply greatly accelerating repetitive labor that previously depended heavily on individual experience.

One-line Summary

XBOW used publicly available AI models to chain three unknown Chrome vulnerabilities in six days; Google fixed them and paid a maximum $250,000 bounty.

Paragraph Summary

Security firm XBOW used publicly available AI models to chain three previously unknown Chrome vulnerabilities into a complete attack chain in six days, enabling Windows users to be implanted with and execute code simply by opening a webpage — no clicks or downloads required. AI handled source code retrieval, attack idea validation, prototype building, and draft writing, while human researchers selected targets and provided direction; the sprint-phase model cost was approximately $40,000. The three vulnerabilities were located in the code execution engine, image reading module, and error handling system. After Google confirmed them, fixes were rolled out in stages within the 152 version cycle, and a maximum-tier bounty of $250,000 was paid. Before the patches, approximately one billion Windows Chrome users were at risk. Researchers note that a vulnerability research process that used to take months has been compressed into six days, the time gap between vulnerability discovery and weaponization is shrinking sharply, and defenders' response windows are narrowing in tandem.