aifollow.news Search
← Back to eventsLatest development 10月14日 10:58
STORY IN FOCUS

GPT-5.6 辅助发现 Chrome 漏洞链，Google 修复三处漏洞并发放 25 万美元奖励

Xbow 工程师 Brendan Dolan-Gavitt 用 OpenAI 的 gpt-5.6-sol 分析 Chrome 源码；智能体搜索代码、测试假设并起草攻击步骤，由工程师决定目标及如何组合结果。最终漏洞链可让标签页中的 JavaScript 越过两道保护边界，在所有沙箱之外运行。Google 复现并修复了三处漏洞，发放 25 万美元奖励。

1 developments2 reports1 sources

Event developments

Coverage of the same occurrence shares a node; subsequent developments have their own nodes.

GPT-5.6 aided a Chrome exploit chain; Google fixed three flaws and awarded $250,000

Xbow engineer Brendan Dolan-Gavitt used OpenAI’s gpt-5.6-sol to analyze Chrome’s source code. Agents searched code, tested hypotheses and drafted exploit stages, while engineers chose targets and decided how to combine the results. The resulting chain let JavaScript in a Chrome tab cross two protective boundaries and run code outside every sandbox. Google reproduced the chain, fixed all three flaws and awarded $250,000.

View source reports · 1 sources · 2 reports
All reports · 2

By original publication time, with each report's bookmarks and feedback preserved.

Rohan Paul (@rohanpaul_ai) 同事件 机器翻译
编辑优先级 53/100
Xbow Engineer Uses GPT-5.6 to Find Three Chrome Flaws; Google Ships Fixes

Xbow engineer Brendan Dolan-Gavitt used OpenAI’s gpt-5.6-sol to analyze Chrome’s source code. AI agents searched the code, tested hypotheses and drafted exploit stages, while engineers selected targets and assembled the chain. The finished exploit let ordinary JavaScript in a Chrome tab cross two protective boundaries. Google reproduced the chain, fixed all three bugs and awarded a $250,000 bounty. Xbow estimated the compute cost at roughly $40,000.

另有 1 家信源报道Rohan Paul (@rohanpaul_ai) 同一事件，精选展示《GPT-5.6 辅助发现 Chrome 漏洞链，Google 修复三处漏洞并发放 25 万美元奖励》
Rohan Paul (@rohanpaul_ai) 精选 机器翻译
编辑优先级 60/100
GPT-5.6 aided a Chrome exploit chain; Google fixed three flaws and awarded $250,000

Xbow engineer Brendan Dolan-Gavitt used OpenAI’s gpt-5.6-sol to analyze Chrome’s source code. Agents searched code, tested hypotheses and drafted exploit stages, while engineers chose targets and decided how to combine the results. The resulting chain let JavaScript in a Chrome tab cross two protective boundaries and run code outside every sandbox. Google reproduced the chain, fixed all three flaws and awarded $250,000.

另有 1 家信源报道Rohan Paul (@rohanpaul_ai)
推荐理由：这起案例具体展示了 AI 智能体与安全研究人员如何分工完成浏览器漏洞链；Google 已复现、修复漏洞并发放奖励。