Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain
Security researchers at XBOW successfully developed a Chrome full-chain exploit in just six days using AI agents to automate vulnerability research and exploit development. This achievement highlights the accelerating speed of offensive security capabilities enabled by advanced AI models.
Why it matters
The rapid development of complex exploits using AI signals a paradigm shift in cybersecurity, where the barrier to entry for high-level attacks is significantly lowered.
The final chain combined a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad. Together they turned JavaScript execution in an ordinary Chrome tab into code execution outside the renderer sandbox.
Google awarded this chain the first $250,000 Chrome full-chain reward under the VRP rules introduced in April 2026. Our separate announcement covers the award and what it means for XBOW. This post is about the exploit: the boundaries it crossed, the root cause of each vulnerability, and the interfaces that connected them.
A web page in signed Chrome Beta launches Calculator via XBOW’s full chain exploit.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in