安全初创公司Xbow的研究人员使用了OpenAI的GPT-5.6 Sol模型，帮助将Chrome中的三个零日漏洞串联成一个能够在Windows机器上执行浏览器沙箱外代码的利用链。Xbow估计，这可能影响全球约十亿用户。谷歌已修复了这三个漏洞，并向Xbow团队支付了25万美元的赏金，这是其对Chrome全链利用的最高奖励。这笔付款也证明了对人类漏洞猎人——Brendan Dolan-Gavitt、Andres Luksenberg、Baul Lee和Willem Pinckaers——的良好投资回报，他们仅在Black Hat和DEF CON大会期间花费了六天时间以及约4万美元的token费用，就发现了这些漏洞并构建了攻击链。
Researchers at security startup Xbow used OpenAI's GPT-5.6 Sol model to help chain three zero-day vulnerabilities in Chrome into an exploit capable of executing code outside the browser's sandbox on Windows machines. Xbow estimates that this could affect about one billion users worldwide. Google fixed all three, and paid the Xbow team a $250,000 bounty, its top reward for a Chrome full-chain exploit. The payout also proves a nice return on investment for the human bug hunters - Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers - who spent just six days during the Black Hat and DEF CON conferences and about $40,000 in token charges to discover the vulnerabilities and build the attack chain.
“支票上的数字令人印象深刻，但我们的团队在公开可用的AI模型帮助下实现突破所用的时间更令人印象深刻，”Xbow首席执行官兼创始人Oege de Moor周二表示。“一位曾在三字母情报机构服役的老兵告诉我，他的团队以前要花六个月时间才能识别此类漏洞并获得完全访问权限。我们仅用了六天。”在一份关于攻击链的单独技术说明中，Dolan-Gavitt详细阐述了人类和AI代理所完成的工作。
“The number on the check is impressive, but the time it took our team, with the help of a publicly available AI model, to break in is even more impressive,” Xbow CEO and founder Oege de Moor said on Tuesday. “A three letter intelligence-agency veteran told me that his team used to spend six months trying to identify this kind of vulnerability and get total access. We did it in six days.”In a separate technical writeup about the attack chain, Dolan-Gavitt detailed the work done by humans and AI agents.
代理使用OpenAI的GPT-5.6-Sol模型，搜索源代码、测试团队的假设，并开发了概念验证和利用阶段，他表示。与此同时，AI渗透测试安全初创公司的研究人员选择了目标、提供了上下文、质疑了代理的结果，并决定将哪些攻击组件串联起来。“我们确实应用了相当多的自身人类专业知识和判断，”他写道。在三个步骤中跨越两个安全边界谷歌的Chrome浏览器使用多层安全机制来保护用户，其中包括沙箱——用于包含受损代码的屏障，以确保黑客入侵单个网站的人无法控制整台电脑。
Agents, using OpenAI's GPT-5.6-Sol model, searched source code, tested the team’s hypotheses, and developed proofs of concept and exploit stages, he said. Meanwhile, the AI pen-testing security startup’s researchers chose targets, provided context, challenged the agents’ results, and decided which attack components to chain. "We did apply a fair bit of our own human expertise and judgment," he wrote. Crossing two security boundaries in 3 steps Google’s Chrome browser uses several layers of security to protect users, and this includes sandboxes - barriers to contain compromised code and ensure that someone who hacks an individual website can’t take over the entire computer.
这包括部署 V8 沙箱，以防止 V8 JavaScript 引擎中的任何内存损坏缺陷影响其他内存。V8 沙箱位于操作系统进程沙箱内，这种嵌套设计意味着逃逸 V8 的内存限制不会自动授予原生代码执行。即使攻击者在 Chrome 渲染器中实现了原生代码执行，外部进程沙箱也会限制其对机器其余部分的访问。“该链在三个漏洞阶段跨越了两个边界，” Dolan-Gavitt 写道，利用 Chrome 在 Windows 机器上运行代码。
This includes deploying the V8 sandbox to prevent any memory corruption flaws in the V8 JavaScript engine from impacting other memory. The V8 sandbox sits inside the operating-system process sandbox, and this nested design means that escaping V8's memory restrictions doesn't automatically grant native code execution. Even if an attacker achieves native code execution inside Chrome's renderer, the outer process sandbox restricts access to the rest of the machine. “The chain crossed both boundaries in three vulnerability stages,” abusing Chrome to run code on Windows machines, Dolan-Gavitt wrote.
该攻击结合了 V8 编译器漏洞、动态 WebP 解码器漏洞以及 Crashpad 中的内存安全漏洞。第一个漏洞位于 Maglev，即 V8 的中层优化编译器，其原因是在反优化过程中使用了被重复使用的可变装箱数字。这使攻击者能够在 V8 的指针压缩笼中获得读写访问权限。第二阶段，动态 WebP 漏洞，是一个 V8 沙箱逃逸。“但我们并未直接攻击沙箱本身，而是利用了 V8 沙箱故意不执行的一个属性，而 Blink 错误地认为它可以信任该属性，” Dolan-Gavitt 解释道。
The attack combines a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad. The first vulnerability is in Maglev, V8's mid-tier optimizing compiler, and it’s due to a reused, mutable boxed number during deoptimization. This gives attackers read and write access throughout V8's pointer-compression cage. The second stage, the animated-WebP bug, is a V8 sandbox escape. “But rather than attacking the sandbox itself we exploited a property that the V8 sandbox deliberately does not enforce and that Blink incorrectly assumed it could trust,” Dolan-Gavitt explained.
“最后，该利用通过 Crashpad 中的溢出跨越最终的外部进程边界，在宿主机上实现了未沙箱化的代码执行。”虽然谷歌已修复了所有三个安全问题，且 Chrome 会自行安装更新，但修复仅在用户重新启动浏览器后才生效。如果你使用 Chrome，请确保你运行的版本为 152.0.7977.82 或更高。达成完整链 Chrome 漏洞利用所花费的时间和金钱再次说明——“对于配备大语言模型的攻击者来说，门槛显著降低”，Dolan-Gavitt 写道。“请相应地进行防御。”®
“Finally, the exploit used an overflow in Crashpad to cross the final outer process boundary and achieve unsandboxed code execution on the host.”While Google patched all three security issues, and Chrome installs updates on its own, a fix only takes effect once the user relaunches the browser. If you use Chrome, make sure you are running version 152.0.7977.82 or later. The time and money spent to achieve a full chain Chrome exploit illustrate - yet again - that “the bar is significantly lower” for attackers armed with LLMs, Dolan-Gavitt wrote. “Defend accordingly.”®