A chain of flaws in Google Chrome could have handed attackers control of one billion Windows machines worldwide — and researchers found it for roughly $40,000 in AI compute time.

The team at Xbow USA spent six days building the exploit. Google paid them a $250,000 bug bounty for it, the first awarded under the company's new 2026 patch-reward rules.

To put the economics in perspective: that's a $6,250 return for every day of work, on a spend smaller than many enterprises' annual SaaS line items. The vulnerability itself, though, touched a browser footprint that spans a tenth of the world's PCs.

The model at the center of the work wasn't a bespoke security tool. It was OpenAI's GPT-5.6 Sol — a publicly available model anyone can rent. The researchers used it to search Chrome's source code, test hypotheses, and build proofs of concept. Humans set the strategy, picked where to look, and checked the output.

What exactly did the exploit do?

The team chained vulnerabilities to break out of two containment layers in sequence:

• First, an escape from the sandbox holding the V8 JavaScript engine
• Then, a second escape from Chrome's operating-system process sandbox
• Finally, launching a Windows application directly from within a malicious web page

That full chain — from a webpage to code running on the host — is the scenario browser sandboxes exist to prevent. Both layers failed in sequence.

Xbow disclosed everything to Google, and Google has fixed the flaws. The researchers published a detailed account of how the exploit came together on the Xbow blog.

Why a public model changes the math

The demonstration wasn't about breaking Chrome. It was about showing what a general-purpose, off-the-shelf model can do when pointed at a hardened target.

Six days and $40,000 is not a nation-state budget. It's the cost of a mid-sized proof-of-concept project. The capability that once demanded a dedicated exploit-development team now sits behind an API call, with humans steering rather than grinding through source code line by line.

What does this change for security teams?

The practical question for CISOs is exposure speed. If a public model can find a sandbox escape chain in under a week, the window between a flaw's discovery and its weaponization shrinks accordingly. Patch cadence for browser deployments — often the most lagging endpoint software in the enterprise — just became a harder SLA to defend.

The good news here is procedural: this chain went through responsible disclosure, earned the maximum-visibility bounty tier, and is closed. The next team with $40,000 may not file a report.

Chrome on Windows remains patched as of the fix. The lesson isn't about one browser — it's about the price of finding the next one.