Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain

XBOW researchers used AI agents to develop a Chrome full-chain exploit in just six days—dramatically faster than the previous 6-9 month timeline—by combining a V8 compiler bug, a WebP decoder vulnerability, and a Crashpad memory-safety flaw to escape the renderer sandbox. Google awarded this exploit chain the first $250,000 Chrome full-chain reward under updated VRP rules, with the project costing approximately $40,000 in API charges and demonstrating how AI-assisted vulnerability research is accelerating offensive security capabilities.