Artificial intelligence created an attack for Chrome in six days

Researchers at security firm XBOW used an AI model to build a full-chain Google Chrome exploit combining three unknown bugs in six days.

The agentic workflow handled source code analysis, proof-of-concept testing, and initial drafts.

Google confirmed the vulnerabilities, released patches, and paid a $250,000 reward.

Security firm XBOW announced that its researchers used a publicly available artificial intelligence model to connect three previously unknown Chrome vulnerabilities. The result was an attack that could execute code on a Windows computer simply by visiting a web page, without the user having to click or download anything.

Google confirmed the issues, fixed them, and awarded XBOW the maximum bounty of $250.000 for a complete attack of this type. According to the company, the attack was never used on real users before it was fixed.

How the AI-assisted attack worked

The attack was completed in six days, between August 2 and 7, 2026. However, the company had months of preparation and testing to complete. The cost of using artificial intelligence for that six-day period was approximately $40.000.

The AI ​​programs were tasked with searching the browser code, testing ideas, building prototypes, and writing the first drafts. The researchers selected the goals, provided direction, and guided the process.

READ ALSO

Serious security flaw in Linux kernel allows complete control of systems

Researcher Brendan Dolan-Gavitt noted that, while before the use of such tools such a process took months, it was now completed in just six days.

The problems and fixes

The three issues used were located in different parts of Chrome:

• The first concerned the code execution engine.
• The second was in the section that reads images.
• The third was detected in the error handling system.

Google confirmed all three issues and fixed them. Specifically, the error handling issue was fixed in version 152.0.7977.65 on August 25, while the code execution engine issue was fixed in version 152.0.7977.82 on September 3. The image reading issue was also fixed in the version 152 update cycle.

Google noted that, before the fixes were released, these issues put about a billion people using Chrome on Windows at risk.

G

Hacks.gr on Google

Set it as a preferred source for cybersecurity updates.

Preferred source

Read the original English article on Hacks.gr