XBOW 六天內構建 Chrome 完整漏洞利用鏈，並列出本週應留意的 3 項修補
Inside XBOW's 6-day Chrome full chain, and the 3 patches to check this week
XBOW 稱，其研究人員在 AI 智能體協助下，於 2026 年 8 月 2 日至 7 日用六天構建出 Windows 版 Chrome 完整漏洞利用鏈，令程式碼可在 Chrome 沙盒外執行。
On Oct 13, XBOW published a write-up of how it built a full Chrome exploit chain on Windows in six days, with AI agents doing much of the legwork. Here's what happened, what it means for patch timelines, and three updates worth checking this week.
The chain
XBOW says it built the chain from Aug 2 to Aug 7, 2026, using three bugs:
- Memory corruption in V8 (Maglev), Chrome's JavaScript engine.
- A bug in the animated-WebP decoder that escaped V8's sandbox (CVE-2026-85045).
- An out-of-bounds write in Crashpad, Chrome's crash handler, that escaped Chrome's own sandbox (CVE-2026-78952).
End result: code running outside Chrome's sandbox.
Who did what
This was not "AI hacked Chrome by itself." In XBOW's words, AI agents searched source code, tested hypotheses, built proofs of concept and developed exploit stages. XBOW's researchers chose targets, supplied context, challenged results, redirected searches and decided which pieces to join.
The numbers, as XBOW reports them
- Six days for the awarded chain. It built on an earlier attempt that was disqualified.
- Roughly $40,000 in API charges, reconstructed from logs.
- XBOW says Google awarded the first $250,000 Chrome full-chain reward. Google's release note lists the reward as TBD.
- XBOW says the bugs were never used against Chrome users.
Why defenders should care
If a week and about $40k can produce a full browser chain, a month-long patch delay is a real exposure window. The chain also went through a crash handler that trusted input from the renderer. Anything that crosses a privilege boundary deserves the same suspicion as input from the internet.
Three patches to check this week
| Product | Fixed version | Source |
|---|---|---|
| Chrome (Windows) | 152.0.7977.82 or later | Chrome Releases (via The Hacker News, Oct 14) |
| Ivanti Connect Secure | 22.8R2.5 / 25.1.1.2 | Ivanti advisory, Oct 13 |
| Linux kernel (Vghost, CVE-2026-74580) | 6.1.183+ / 6.6.152+ / 6.12.104+ or any patched stable or distro kernel. Then reboot. | Linux kernel CVE team, Aug 21 |
On Ivanti: Volexity reports three chained zero-days exploited from Oct 3 against an appliance on 22.8R2.4, which was the latest build at the time.
Sources
- XBOW: Zero to calc in six days
- XBOW advisory: CVE-2026-78952
- Chrome stable update, Aug 2026
- Linux kernel CVE notice: CVE-2026-74580
- Volexity on Ivanti Connect Secure
I post short breakdowns like this on X at @kyo_rush.
來源：DEV Community · dev.to