XBOW Security Team Develops Complete Chrome Exploit in Six Days Using Public AI Model

Researchers at cybersecurity firm XBOW disclosed that they have built a full‑chain exploit for Google Chrome capable of running arbitrary code on a Windows system merely by visiting a malicious webpage. The attack links three previously unknown Chrome vulnerabilities, forming a chain that progresses from a remote‑code‑execution flaw in the browser's rendering engine to a privilege‑escalation defect in the Windows process that hosts Chrome.

XBOW states the entire chain was assembled in only six days. The team employed a publicly accessible OpenAI model, tasking several AI agents with locating, verifying, and merging candidate vulnerabilities. By prompting the model with the desired outcome—executing code from a web page—the AI proposed potential exploit primitives, which the researchers then refined and connected.

The deployment of a general‑purpose language model for exploit creation underscores a rising trend in security research, where AI accelerates both the discovery and exploitation of software bugs. Although the OpenAI model does not contain proprietary Chrome knowledge, its capacity to produce credible code snippets and suggest logical steps can sharply reduce the time needed to turn a vulnerability report into a functional exploit.

Google has not yet acknowledged the three flaws, but it typically reacts to zero‑day reports with patches and security updates. XBOW’s disclosure adheres to responsible‑release conventions, supplying the browser vendor with details so mitigations can be rolled out before the exploit is weaponized in the wild. The case highlights the critical need for swift patch cycles for browsers, which remain a major attack vector for nation‑state actors and cybercriminals alike.

Analysts note that this incident may push software vendors to reevaluate how they gauge the risk posed by publicly available AI tools. If AI can help stitch together separate bugs into an operational chain, the hurdle for crafting sophisticated attacks could be lowered, elevating the importance of defenses such as exploit‑mitigation technologies, sandboxing, and continuous vulnerability scanning. It also serves as a reminder that even well‑maintained browsers like Chrome can conceal hidden defects that, when combined, present a serious threat to users.