Google paid $250,000 for a Chrome chain whose three bugs it had separately priced at $4,500

XBOW says it built a working Chrome exploit chain in six days using a publicly available OpenAI GPT-5.6 Sol model, and that Google paid $250,000 for it. Both halves are true, and both were reported widely this week.

The part that was not reported is on Google's own issue tracker. The three bugs that make up the chain were each rewarded separately by the Chrome Vulnerability Rewards Program panel, and those three awards come to $4,500.

The chain, in Google's words rather than XBOW's

Chromium issue 547965190 is titled "Full chain exploit from ordinary web content on Chrome Beta 152.0.7977.42 for Windows". It is a P0, filed from an xbow.com address on 18 August 2026, and it is marked Fixed.

The chain ran in "signed stock Google Chrome Beta 152.0.7977.42 on Windows x64", and ends by making "the existing unsandboxed Crashpad handler create cmd /k calc.exe through its normal CreateProcessW path". Launching Calculator is the traditional way to prove code execution without doing anything with it.

Three separate issues are recorded as blocking that one. They are the three links.

What each link actually crossed

Issue 547819997 is the first. Maglev, one of V8's compilers, built a single mutable number object and handed the same one to every object it later reconstructed, so two different JavaScript objects could share one box. The issue's own impact line is careful in a way the coverage was not: "Arbitrary read/write within the V8 cage from ordinary web content. The V8 heap sandbox contains this primitive; native renderer code execution requires a separate sandbox escape." The first link is not an escape at all. It is CVE-2026-85045, described by Google as a race condition in V8, fixed in Chrome 152.0.7977.82 on 3 September.

Issue 548509153 is the second, and it is the one that escapes the V8 sandbox. Blink's animated WebP decoder kept the frame geometry it had measured from one image and used it against bytes that had since been replaced with a different one, which produced a single chosen write outside V8's pointer cage.

Issue 545820931 is the third, and the only one that crosses an operating-system boundary. Crashpad, the crash handler, inferred how much memory it could read from a read that had already failed, and a renderer thread that was still running changed the memory protections between the two attempts. It is CVE-2026-78952, an out-of-bounds write in Crashpad, fixed in Chrome 152.0.7977.64 on 25 August.

The middle link has no CVE, and is rated as having no security impact

Issue 548509153 carries the label Security_Impact-None, is rated P2 and S2, and its CVE field is empty. A Chromium engineer explained the rating on the issue the day after it was filed: "It is a V8 sandbox escape, hence S2 (not the OS sandbox, but the pointer cage that v8 implements)."

That is the V8 sandbox's actual status, stated plainly. It is a mitigation that makes corruption inside V8 harder to turn into code execution, not a boundary Chrome commits to defending, which is why escaping it alone is not a critical finding. XBOW says the team exploited a property the V8 sandbox deliberately does not enforce and that Blink wrongly assumed it could trust.

It is also the bug that earned the largest individual reward of the three: $2,500. The two bugs that did get CVEs earned $1,000 each.

$4,500 in parts, $250,000 assembled

The chain issue carries a comment from the program's own bot: "Chrome Vulnerability Rewards Program (VRP) Panel has decided to issue a reward of $250000." An earlier comment records a Chrome engineer adding a hotlist "ensuring the VRP panel will take the full chain into account for reward consideration".

This is not Google underpaying and then correcting itself. It is the program working exactly as designed, and the arithmetic is the clearest statement anyone has published of what it is buying. A memory-safety bug, priced as a bug, is worth a four-figure sum. The same bug, demonstrated as one link in a path from a web page to the machine, is worth more than fifty times the three of them together. The program pays for demonstrated exploitability, not for bug count.

The $1,000 figures are familiar. We wrote in September about a Chrome V8 zero-day that was paid $1,000 when the program's published floor for that class was $7,000. Both XBOW bugs appeared in Chrome's release notes with the reward listed as "TBD", and the amounts landed on the tracker later.

Six days, measured against what

XBOW's sprint ran from 2 to 7 August in Las Vegas, during Black Hat and DEF CON. The three bug reports are dated 13, 17 and 19 August, so the week produced the exploit and the fortnight after it produced the filings and the retargeting.

The compute is XBOW's figure: "roughly $40,000 in API charges", reconstructed from archived Codex logs rather than billed as a line item. The comparison that made the headlines is also XBOW's, and carries no source: "Pre-LLMs a Chrome full chain would take a team of four around 6-9 months to be produced, our first submission took 2 months. The awarded one? six days."

The first chain did not win. Its V8 sandbox escape turned out to duplicate an existing report, which is why the animated WebP bug is in the chain at all. XBOW builds each stage with a spare for exactly this reason, and says of the result that "this does not mean that anyone can get a Chrome chain".

Agents searched the source, tested ideas and wrote the first drafts. People picked the targets, read the output and decided what to join to what. That division is XBOW's own description, and it is the least surprising part of the story.

What to do

• Check your Chrome version. Anyone on a current release has had all three fixes for weeks, the last of them on 3 September, but Chrome does not apply an update until the browser restarts.
• If you manage a fleet, the versions that matter are 152.0.7977.64 and 152.0.7977.82.
• Do not treat the V8 sandbox as a boundary in your own threat model. Google does not.
• If you run a bounty programme, the lesson here is the pricing rather than the AI.

What is not established

• Whether other Chromium-based browsers inherited the same code. Nobody has published an answer, and the third stage is Windows-specific.
• Whether the animated WebP bug will ever receive a CVE. Its CVE field is empty, while the other two issues carry a label indicating a CVE description has been submitted.
• Whether the per-bug awards sit below the programme's published minimums for their classes. We have reported that pattern before; Google does not publish the panel's reasoning.
• The one-billion-user figure, which is XBOW's estimate of scope rather than a count of anything.
• The six-to-nine-month baseline the six days is measured against. It is asserted without a source, and the six days followed months of prior work by the same team.
• Whether any of the three bugs was ever used against real users. XBOW says none were, and no telemetry has been published either way.