XBOW Security Team Builds Complete Chrome Exploit in Six Days Using Public AI Model

Researchers from the cybersecurity firm XBOW disclosed that they have put together a complete Chrome exploit capable of running arbitrary code on a Windows system merely by visiting a malicious webpage. The exploit links three previously undisclosed Chrome vulnerabilities, forming a chain that progresses from a remote code‑execution issue in the browser’s rendering engine to a privilege‑escalation defect in the Windows process that runs Chrome.

XBOW states that they built the full chain in only six days. To do so, they employed a publicly accessible OpenAI model, guiding several AI agents to locate, verify, and merge potential vulnerabilities. When presented with prompts outlining the target action—executing code via a web page—the model produced candidate exploit primitives, which the researchers then polished and integrated.

Employing a general‑purpose language model for building exploits underscores an emerging pattern in security research, as AI utilities speed up both the identification and weaponisation of software bugs. Although the OpenAI model lacks any proprietary insight into Chrome’s codebase, its capacity to produce credible code fragments and propose logical sequences can greatly reduce the interval between a vulnerability disclosure and a functional exploit.

Google has not publicly acknowledged the three flaws, though it usually addresses zero‑day reports with patches and updates. XBOW adhered to conventional responsible‑disclosure protocols, sharing the findings with the browser maker to allow mitigations before the exploit could be deployed in the wild. This case highlights why swift patch cycles are critical for browsers, which continue to be a major target for nation‑state hackers and cybercriminals alike.

Analysts suggest the episode could lead software vendors to re‑evaluate how they gauge the threat posed by publicly accessible AI utilities. Should AI assist in weaving separate vulnerabilities into a working chain, the hurdle for crafting advanced attacks may drop, intensifying the need for defenses like exploit mitigation, sandboxing, and ongoing vulnerability scanning. The incident also reminds us that even diligently maintained browsers such as Chrome can contain concealed bugs that, when linked, represent a significant danger to users.