IT Home On October 14, a security research team XBOW recently discovered and developed a full-chain Chrome browser vulnerability exploit, which is expected to affect approximately 1 billion users worldwide. The related vulnerability has been reported to Google and fixed. Google also offered a $250,000 bug bounty (IT Home note: approximately 1.676 million RMB at current exchange rate) to the team.
XBOW said that with the help of models such as OpenAI’s GPT-5.6 Sol, and four researchers, they broke through the Chrome vulnerability in just 6 days and gained full system access. According to an industry expert, similar work would take about 6 months if done entirely by humans.
The computing resources invested by the team in researching vulnerabilities were approximately $40,000 (equivalent to about 268,000 RMB at current exchange rates). The AI was responsible for searching the Chrome source code, testing ideas, building proof-of-concept programs, and writing the initial version of the vulnerability exploitation program. The team members, on the other hand, were in charge of developing overall strategies, deciding research directions, checking the work outcomes of the agent, and adjusting the agent’s actions based on the initial test results.
XBOW reminds all users to make sure Chrome browser is at the latest version, and the three vulnerabilities they found have been fixed by Google.