A security research firm says its automated system went from a blank slate to full code execution against Chrome in six days.
XBOW published a technical write-up describing how its automated vulnerability-hunting system built what researchers call a full chain against Google's browser, stringing together multiple bugs until it could pop a calculator, the standard proof that arbitrary code is running on the target. The company says the whole process, from zero known vulnerabilities to a working exploit, took six days. The piece ran as original research on XBOW's own site, and picked up only a handful of upvotes and a single public comment when it circulated.
That matters because full chains against a modern browser are supposed to be hard. Chrome's sandbox and layered mitigations exist specifically so that one bug alone cannot deliver code execution, which is why complete chains usually take skilled human teams weeks or months, not days. If XBOW's timeline holds up, it says less about a specific hole in Chrome and more about how fast automated, AI-assisted bug hunting is catching up to that bar.
The write-up is still the only account of what happened, so treat the six-day figure the way you'd treat any vendor's own benchmark: notable if it holds, but not confirmed until someone outside XBOW reproduces it.