The latest articles on DEV Community by kyo (@kyo_rush). https://dev.to/kyo_rush https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4185023%2Fa344a6cf-4293-465e-8f21-d3364e948756.png https://dev.to/kyo_rush en kyo Wed, 14 Oct 2026 15:26:50 +0000 https://dev.to/kyo_rush/inside-xbows-6-day-chrome-full-chain-and-the-3-patches-to-check-this-week-4m5j https://dev.to/kyo_rush/inside-xbows-6-day-chrome-full-chain-and-the-3-patches-to-check-this-week-4m5j <p>On Oct 13, XBOW published a write-up of how it built a full Chrome exploit chain on Windows in six days, with AI agents doing much of the legwork. Here's what happened, what it means for patch timelines, and three updates worth checking this week.</p> <h2> The chain </h2> <p>XBOW says it built the chain from Aug 2 to Aug 7, 2026, using three bugs:</p> <ol> <li>Memory corruption in V8 (Maglev), Chrome's JavaScript engine (CVE-2026-85045).</li> <li>A bug in the animated-WebP decoder that escaped V8's sandbox.</li> <li>An out-of-bounds write in Crashpad, Chrome's crash handler, that escaped Chrome's own sandbox (CVE-2026-78952, Windows only).</li> </ol> <p>End result: code running outside Chrome's sandbox.</p> <h2> Who did what </h2> <p>This was not "AI hacked Chrome by itself." In XBOW's words, AI agents searched source code, tested hypotheses, built proofs of concept and developed exploit stages. XBOW's researchers chose targets, supplied context, challenged results, redirected searches and decided which pieces to join.</p> <h2> The numbers, as XBOW reports them </h2> <ul> <li>Six days for the awarded chain. It built on an earlier attempt that was disqualified.</li> <li>Roughly $40,000 in API charges, reconstructed from logs.</li> <li>XBOW says Google awarded the first $250,000 Chrome full-chain reward. Google's release note lists the reward as TBD.</li> <li>XBOW says the bugs were never used against Chrome users.</li> </ul> <h2> Why defenders should care </h2> <p>If a week and about $40k can produce a full browser chain, a month-long patch delay is a real exposure window. The chain also went through a crash handler that trusted input from the renderer. Anything that crosses a privilege boundary deserves the same suspicion as input from the internet.</p> <h2> Three patches to check this week </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Product</th> <th>Fixed version</th> <th>Source</th> </tr> </thead> <tbody> <tr> <td>Chrome (all platforms)</td> <td>152.0.7977.82 or later</td> <td>Chrome Releases (Google, Aug 25 and Sep 3)</td> </tr> <tr> <td>Ivanti Connect Secure</td> <td>22.8R2.5 / 25.1.1.2</td> <td>Ivanti advisory, Oct 13</td> </tr> <tr> <td>Linux kernel (Vghost, CVE-2026-74580)</td> <td>6.1.183+ / 6.6.152+ / 6.12.104+ or any patched stable or distro kernel. Then reboot.</td> <td>Linux kernel CVE team, Aug 21</td> </tr> </tbody> </table></div> <p>On Ivanti: Volexity reports three chained zero-days exploited from Oct 3 against an appliance on 22.8R2.4, which was the latest build at the time.</p> <h2> Sources </h2> <ul> <li><a href="https://xbow.com/labs/research/zero-to-calc-in-six-days-inside-xbow-chrome-full-chain" rel="noopener noreferrer">XBOW: Zero to calc in six days</a></li> <li><a href="https://xbow.com/labs/advisories/cve-2026-78952" rel="noopener noreferrer">XBOW advisory: CVE-2026-78952</a></li> <li><a href="https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html" rel="noopener noreferrer">Chrome stable update, Sep 3, 2026</a></li> <li><a href="https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html" rel="noopener noreferrer">Chrome stable update, Aug 25, 2026</a></li> <li><a href="https://lists.openwall.net/linux-cve-announce/2026/08/21/4" rel="noopener noreferrer">Linux kernel CVE notice: CVE-2026-74580</a></li> <li><a href="https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/" rel="noopener noreferrer">Volexity on Ivanti Connect Secure</a></li> </ul> <p>I post short breakdowns like this on X at <a href="https://x.com/kyo_rush" rel="noopener noreferrer">@kyo_rush</a>.</p> security chrome ai linux