The report
XBOW has published a technical reconstruction of a Chrome exploit chain built with AI-assisted research. The stages cross different boundaries: a V8 Maglev optimization error, an animated WebP decoding bug that reaches outside the V8 heap cage, and a Crashpad process flaw that escapes the outer renderer sandbox. XBOW reports that Google validated the chain and awarded $250,000.
The six-day duration and roughly $40,000 of model API expense describe the researchers' reported effort, not the cost of automatically exploiting arbitrary browsers. Human researchers framed the targets, inspected results and assembled the stages. Google patch records must be checked separately before attaching specific CVE identifiers to the WebP stage, because the public announcement appears to conflate one mapping.
The technical case distinguishes a reproduced exploit from deployment against real users. Its significance is the compression of specialist exploit work through a harness, not evidence of an autonomous browser-targeting epidemic.
Why the stages must be counted separately
A browser renderer compromise is not equivalent to escape from the full Chrome process boundary. The V8 optimization issue gave the chain its initial capability, the animated-image flaw crossed another isolation layer, and the Crashpad issue moved beyond the renderer. Demonstrating a complete chain therefore required compatible versions and successful transitions across three separate components, not merely prompting an agent to write exploit code. A single model score or elapsed-time claim says little about how much human exploitation work remained.
The published reward and Calculator demonstration support a successful controlled submission. They do not establish a self-propagating exploit, a field campaign or a reliable cost per victim. The case record keeps the mapping uncertainty for individual CVEs explicit rather than assigning unverified identifiers to the stages.