Cybersecurity company XBOW announced on October 13 that one of its security researchers, with the assistance of the OpenAI GPT-5.6 Sol model and AI agents, used 6 days to build a complete Chrome attack chain composed of 3 previously unknown vulnerabilities and received a 250,000 dollar bug reward from Google, the first Chrome full-link reward under Google's new 2026 rules. The attack chain first uses a vulnerability in the V8 JavaScript engine to obtain sandbox memory control, then breaks through the sandbox through the Chrome dynamic WebP decoder vulnerability CVE-2026-85045, and finally uses the CrashPad vulnerability CVE-2026-78952 running outside the sandbox to achieve complete code execution. It can be triggered only when the user loads a web page, and no additional download or click is required. According to XBOW, before being fixed, this type of vulnerability theoretically affected about 1 billion Windows Chrome users around the world, and the entire research process is estimated to have consumed about 40,000 US dollars in computing power. The relevant bugs have been reported to Google and fixed, and XBOW says there is no evidence that these vulnerabilities have been used in actual attacks.

Disclaimer:Webull uses external vendor Google Translation Service for news translations where we endeavour to ensure these are correct, however, we recommend that you please double-check this information accordingly. Webull is not responsible for translation errors or issues.