Inside XBOW's 6-day Chrome full chain, and the 3 patches to check this week

On Oct 13, XBOW published a write-up of how it built a full Chrome exploit chain on Windows in six days, with AI agents doing much of the legwork. Here's what happened, what it means for patch timelines, and three updates worth checking this week.

The chain

XBOW says it built the chain from Aug 2 to Aug 7, 2026, using three bugs:

1. Memory corruption in V8 (Maglev), Chrome's JavaScript engine.
2. A bug in the animated-WebP decoder that escaped V8's sandbox (CVE-2026-85045).
3. An out-of-bounds write in Crashpad, Chrome's crash handler, that escaped Chrome's own sandbox (CVE-2026-78952).

End result: code running outside Chrome's sandbox.

Who did what

This was not "AI hacked Chrome by itself." In XBOW's words, AI agents searched source code, tested hypotheses, built proofs of concept and developed exploit stages. XBOW's researchers chose targets, supplied context, challenged results, redirected searches and decided which pieces to join.

The numbers, as XBOW reports them

• Six days for the awarded chain. It built on an earlier attempt that was disqualified.
• Roughly $40,000 in API charges, reconstructed from logs.
• XBOW says Google awarded the first $250,000 Chrome full-chain reward. Google's release note lists the reward as TBD.
• XBOW says the bugs were never used against Chrome users.

Why defenders should care

If a week and about $40k can produce a full browser chain, a month-long patch delay is a real exposure window. The chain also went through a crash handler that trusted input from the renderer. Anything that crosses a privilege boundary deserves the same suspicion as input from the internet.

Three patches to check this week

On Ivanti: Volexity reports three chained zero-days exploited from Oct 3 against an appliance on 22.8R2.4, which was the latest build at the time.

Sources

• XBOW: Zero to calc in six days
• XBOW advisory: CVE-2026-78952
• Chrome stable update, Aug 2026
• Linux kernel CVE notice: CVE-2026-74580
• Volexity on Ivanti Connect Secure

I post short breakdowns like this on X at @kyo_rush.