Post

How we chained three vulnerabilities into a full Chrome exploit in just 6 days—claiming Google’s first $250,000 full-chain reward of 2026 for an attack affecting an estimated 1 billion users. 🧵

1/ Instead of asking one agent to produce an exploit end to end, we split the work into parallel campaigns: broad vulnerability search, V8 memory corruption, a V8 sandbox escape, a renderer sandbox escape, and integration.

2/ AI agents using OpenAI’s gpt-5.6-sol model searched source code, tested hypotheses, built proofs of concept, and developed exploit stages. Reconstructing usage from the archived Codex logs puts the six-day campaign at roughly $40,000 in API charges.

3/ The chain crossed two sandbox boundaries in three vulnerability stages: 1. Maglev reused a mutable boxed number during deoptimization 2. Animated WebP combined cached geometry with changed image bytes 3. Crashpad trusted a failed read from a supposedly frozen renderer

4/ Stage 1, Mutating the Immutable: the vulnerable Maglev path made a mutable number look like exactly the sort of immutable constant the compiler was allowed to reuse—giving reliable memory access from JavaScript throughout the V8 sandbox.

5/ Stage 2, Two WebPs Diverged in a V8 Cage: we made a conscious decision to avoid attacking the sandbox itself. Both WebPs were valid on their own—the unsafe state existed only because Blink combined A's cached geometry with B's current bytes.

6/ Stage 3, The Renderer Refuses to Chill Out: Crashpad runs outside the renderer sandbox and trusted that a frozen process couldn't change. A Windows freeze-exempt thread flipped page protections mid-read—code exec in the unsandboxed crash handler. calc popped. 🧮