“在LLMs之前，Chrome的完整链条需要一个四人团队花费6-9个月才能完成，我们的首次提交用了2个月。获奖的那个？六天，”XBOW研究员Brendan Dolan-Gavitt在一篇技术说明中写道。
“Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days,” XBOW researcher Brendan Dolan-Gavitt wrote in a technical write-up.
安全公司XBOW于10月13日表示，已从谷歌的Chrome漏洞赏金计划中获得25万美元。他们使用运行OpenAI的GPT-5.6 Sol的AI代理构建了该漏洞利用。该攻击链接了三个此前未知的Chrome漏洞。加载一个网页即可在Windows电脑上运行Chrome沙箱之外的代码，无需点击或下载。
Security company XBOW has won $250,000 from Google’s Chrome bug bounty programme, XBOW said on 13 October. It built the exploit with AI agents running OpenAI’s GPT-5.6 Sol. The attack chained three unknown Chrome bugs. Loading a web page was enough to run code outside Chrome’s sandbox on a Windows computer, with no click or download.
XBOW表示，这是谷歌在2026年4月引入的规则下首次获得的完整链条Chrome奖项。谷歌已修复了所有三个漏洞，XBOW表示这些漏洞从未被用于攻击Chrome用户。在修复之前，根据公司的估计，这些漏洞暴露了大约十亿使用Windows系统运行Chrome的人。
XBOW says it is the first full-chain Chrome award under rules Google introduced in April 2026. Google has fixed all three bugs, and XBOW says they were never used against Chrome users. Before the fixes, the bugs exposed about one billion people running Chrome on Windows, by the company’s estimate.
六天与4万美元：Dolan-Gavitt和AI代理在2026年8月2日至7日期间构建了获奖的链条，当时团队正在拉斯维加斯参加Black Hat和DEF CON。XBOW根据其使用日志将计算成本估算为约4万美元。创始人兼首席执行官Oege de Moor表示，公司故意选择了任何人都可使用的模型。
Six days and $40,000 Dolan-Gavitt and the agents built the awarded chain between 2 and 7 August, while the team was in Las Vegas for Black Hat and DEF CON. XBOW puts the compute cost at about $40,000, based on its usage logs. Founder and CEO Oege de Moor wrote that the company chose a model available to anyone on purpose.
这六天是在数月工作之后到来的。De Moor在2026年初马耳他的公司会议上提出了这一挑战。四名研究员接受了挑战：Dolan-Gavitt、Andrés Luksenberg、Baul Lee和Willem Pinckaers。他们的首条链条在谷歌表示已经知道其中一个漏洞时失败，于是团队替换了一个备份阶段。
The six days followed months of work. De Moor set the challenge at a company meeting in Malta at the start of 2026. Four researchers took it on: Dolan-Gavitt, Andrés Luksenberg, Baul Lee and Willem Pinckaers. Their first chain failed when Google said it already knew one of the bugs, so the team swapped in a backup stage.
这些代理搜索了Chrome的源代码，测试了想法，构建了概念验证，并编写了每个阶段的初稿。研究员选择了目标，提供了上下文，质疑了结果，并决定哪些部分需要连接。
The agents searched Chrome’s source code, tested ideas, built proofs of concept and wrote the first drafts of each stage. The researchers chose the targets, supplied context, challenged the results and decided which parts to join.
“我们确实应用了相当多的人类专业知识和判断，”Dolan-Gavitt写道。
“We did apply a fair bit of our own human expertise and judgment,” Dolan-Gavitt wrote.
三个漏洞，两个沙盒 Chrome 在其 V8 引擎中使用沙盒隔离 JavaScript，并通过操作系统运行的第二个沙盒隔离每个页面。攻击链突破了这两层防护。V8 的 Maglev 编译器中存在一个漏洞，使攻击者获得了 V8 沙盒内的读写权限。随后，动态 WebP 图像解码器中的一个漏洞实现了对沙盒外的一次精准写入。
Three bugs, two sandboxes Chrome keeps JavaScript inside a sandbox in its V8 engine, and keeps each page inside a second sandbox run by the operating system. The chain crossed both. A bug in V8’s Maglev compiler gave the attacker read and write access inside the V8 sandbox. A bug in the decoder for animated WebP images then made one chosen write outside it.
第三个漏洞位于 Crashpad 中，这是 Chrome 的崩溃处理程序，运行在沙盒之外。该漏洞将这一次写入转化为完整的代码执行。Chrome 152 的发布说明将 Crashpad 漏洞（CVE-2026-78952，高危）的发现归功于 XBOW 的 Dolan-Gavitt。
The third bug sat in Crashpad, Chrome’s crash handler, which runs outside the sandbox. It turned that single write into full code execution. Google’s release notes for Chrome 152 credit Dolan-Gavitt of XBOW for the Crashpad flaw, CVE-2026-78952, rated high.
这些修复程序随 Chrome 在 8 月 25 日和 9 月 3 日的更新发布，The Hacker News 报道了此消息。Chrome 会自行安装更新，但修复仅在浏览器重启后生效。9 月，Google 还修补了另一个攻击者已在利用的独立 V8 漏洞。
The fixes shipped in Chrome updates on 25 August and 3 September, The Hacker News reported. Chrome installs updates on its own, but a fix only takes effect after the browser restarts. In September, Google also patched a separate V8 flaw that attackers were already using.
公开模型 OpenAI 在 7 月向所有人发布了 GPT-5.6。8 月，它因网络风险暂停了某个模型。De Moor 认为，限制强大模型是错误的问题，因为 XBOW 使用的模型已经是公开的。他预计独立工作的攻击者可能在一年内发现这三个漏洞中的每一个。
A public model OpenAI released GPT-5.6 to everyone in July. In August, it paused a model over cyber risk. De Moor argues that restricting powerful models is the wrong question, because the model XBOW used is already public. He expects agents working alone could find each of the three bugs within a year.
“我们希望帮助更多防御者更快地发现并修复关键漏洞，”OpenAI 网络研究负责人 Clint Gibler 在 XBOW 的新闻稿中表示。
“We want to help more defenders find and fix critical vulnerabilities faster,” Clint Gibler, head of cyber research at OpenAI, said in XBOW’s press release.
Dolan-Gavitt 在其撰写的报告末尾向防御者发出警告。
Dolan-Gavitt ended his write-up with a warning to defenders.
“当收获是一个 Chrome 利用链时，六天和 4 万美元并不是很多时间或金钱，”他写道。“请相应地进行防御。”
“Six days and $40k is not a lot of time or money when the payoff is a Chrome chain!” he wrote. “Defend accordingly.”