CONNECT WITH US
Cyber Security

Cyber Security

Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

The Hacker News logo

Published on

Add as a preferred source on Google
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said.

Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $250,000 reward for a full Chrome exploit.

The attack is a full chain: a set of bugs used together to break every layer of Chrome's protection, from a web page all the way to the computer.

Chrome runs web page code inside two nested sandboxes, the barriers that stop a hacked page from reaching the rest of the machine. The chain crossed both. The result was code running outside Chrome on Windows, with no need for the user to click or download anything.

All three bugs are now fixed, and XBOW says they were never used against Chrome users. The two that carry public identifiers were fixed in Chrome 152.0.7977.65 on August 25 and 152.0.7977.82 on September 3.

Chrome updates on its own, but the fix only takes effect after the browser restarts, so the action is to relaunch Chrome and confirm the version is 152.0.7977.82 or later.

The six days are the headline, and they need their frame. XBOW built the awarded chain between Sunday, August 2, and Friday, August 7, during the Black Hat and DEF CON conferences in Las Vegas.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.