---
title: XBOW: AI-assisted Chrome full-chain (6 days) earns Google's first $250k 2026 VRP award | ctxsec
url: https://ctxsec.com/items/xbow-chrome-fullchain-2026-10
description: ""
status: "confirmed (author's post)"
published: 2026-10-13
---

> 

[← AI](/ai) · [markdown](/items/xbow-chrome-fullchain-2026-10.md)

confirmed (author's post)

2026-10-13

### XBOW: AI-assisted Chrome full-chain (6 days) earns Google's first $250k 2026 VRP award

XBOW published that researchers plus AI agents (OpenAI GPT-5.6 Sol) built a three-bug Chrome→Windows full-chain in six days (Aug 2–7), winning Google's first $250,000 Chrome full-chain VRP under 2026 rules. Chain crossed V8 sandbox and renderer sandbox; bugs were reported, fixed, and never used against users. XBOW estimates ~$40k API compute. Caveat: this is a responsible-disclosure research write-up, not an in-the-wild campaign — keep Chrome updated and relaunch after updates.

Sources: [XBOW blog](https://xbow.com/blog/xbow-built-a-chrome-full-chain-exploit) · [XBOW Labs technical post](https://xbow.com/labs/research/zero-to-calc-in-six-days-inside-xbow-chrome-full-chain)