On October 13, 2026, XBOW said Google awarded it a $250,000 Chrome Vulnerability Reward Program bounty for a Windows exploit chain that escaped the browser sandbox. XBOW says it was the first payout at that level for a full-chain Chrome bug under Google’s 2026 reward rules.
In XBOW’s technical write-up, the company says one researcher working with AI agents built the chain in six days at a cost of about $40,000 in API usage. XBOW says the attack linked three previously unknown bugs in V8, Chrome’s animated-WebP decoder, and Crashpad to reach code execution outside Chrome’s sandbox.
Google’s Chrome VRP update confirms that full-chain browser-process reports can qualify for rewards of up to $250,000, but it does not name XBOW or describe this exploit chain. That means the payout, timeline, and tooling details here are XBOW’s account, while Google’s post supports the reward tier itself.
For security teams, the signal is the pace: if agent-assisted workflows can turn separate browser bugs into a working chain in under a week, fast patching and browser-update automation matter more.