Zero to Calc in Six Days: Inside XBOW’s Chrome Full Chain
- The final chain combined a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad.
- Together they turned JavaScript execution in an ordinary Chrome tab into code execution outside the renderer sandbox.
- Google awarded this chain the first $250,000 Chrome full-chain reward under the VRP rules introduced in April 2026.
Unverified
- The final chain combined a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad.
- Together they turned JavaScript execution in an ordinary Chrome tab into code execution outside the renderer sandbox.
- Google awarded this chain the first $250,000 Chrome full-chain reward under the VRP rules introduced in April 2026.
Sources: Xbow