[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvoqLO0aghE7a6otUe3802xRLysFuSwJEA450g822Ga0":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4b15175f-a5f5-4b65-bf18-d59241805501","Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days","researchers-used-a-public-openai-model-to-build-a-250-000-chrome-full-chain-expl-2c2810","A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $","A security firm successfully chained three previously unknown Google Chrome vulnerabilities into a full-chain exploit. This exploit allows arbitrary code execution on a Windows machine simply by loading a web page. The researchers developed this sophisticated attack in just six days by leveraging AI agents powered by OpenAI's GPT-4.5 Sol model, demonstrating the accelerating pace of exploit development with AI assistance.","Researchers used public AI to build a Chrome exploit in six days, earning $250,000.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fresearchers-used-public-openai-model-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiLXn6RSZOSq2StbSf2fHVaHwVEetIYN0wGfuaIcyaEnwSnXLaY1FBfSKPFzzQuKvtpRygCR7AvNixA-SCkIA98QjnT7gE2UWYtoiZLs5VxQC8KTSJwwlcP0helOb3F4hbSo4uqITjJYPiZHSSuKkm1O_BXFYeyEU7koe_77QSmKbU33o5hteBC5-0dxrs\u002Fs1600\u002Fchrome-exploit.jpg","2026-10-14T11:19:02+00:00","2026-10-14T12:00:06.384658+00:00",9,[17,20,23,25,28,30],{"name":18,"type":19},"Google Chrome","product",{"name":21,"type":22},"AI agents","technology",{"name":24,"type":19},"GPT-4.5 Sol",{"name":26,"type":27},"OpenAI","vendor",{"name":29,"type":27},"Google",{"name":31,"type":27},"XBOW","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40,45],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[29,26,31],{"controls":53,"vendors":138},[54,83,109],{"slug":55,"name":56,"problem":57,"products":58},"patch-management","Automated patch management","Known holes get closed in days, not months.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":84,"name":85,"problem":86,"products":87},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":105,"product_name":106,"url":107,"description":108},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":110,"name":111,"problem":112,"products":113},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",[139],{"slug":140,"name":29,"logo_path":141,"roles":142},"google","\u002Fvendor-logos\u002Fgoogle.png",[143],"affected",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":161},"ai-accelerates-full-chain-chrome-exploit-development-to-just-six-days","AI Accelerates Full-Chain Chrome Exploit Development to Just Six Days","Security researchers demonstrated that AI agents powered by large language models can drastically compress the timeline for developing sophisticated exploit chains, turning what once required weeks or months of expert effort into a six-day task costing roughly $250,000. By chaining three previously unknown (zero-day) Chrome vulnerabilities, the team achieved arbitrary code execution on Windows simply by loading a web page — a critical threat vector affecting virtually every enterprise environment. This development signals a fundamental shift in the threat landscape: defenders can no longer rely on the assumption that complex exploit development is a natural bottleneck for attackers. Organizations must treat zero-day vulnerability windows as significantly shorter than historical norms and accelerate both detection and patching capabilities accordingly.",[149,150,151,152,153,154,155,156,157,158,159,160],"CIS Control 7: Continuous Vulnerability Management","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-18: Mobile Code","MITRE ATT&CK T1203: Exploitation for Client Execution","MITRE ATT&CK T1189: Drive-by Compromise","ITIL: Problem Management — proactive identification of emerging exploit patterns","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]