Xbow spent $40K on AI and cracked Google Chrome wide open
Summary
Researchers at Xbow USA utilized AI compute time costing $40,000 to discover a chain of vulnerabilities in Google Chrome. These flaws allowed them to escape Chrome's sandbox environments and launch a Windows application from a malicious webpage. Google has since fixed these vulnerabilities.
IFF Assessment
The discovery of a full-chain exploit in a widely used browser like Chrome, even if patched, represents a significant potential threat to users and indicates the growing capability of AI in discovering such vulnerabilities.
Severity
The CVSS score of 9.8 reflects the critical nature of a full-chain exploit that allows arbitrary code execution and privilege escalation from a sandboxed environment, potentially affecting a vast number of users.
Defender Context
This article highlights the increasing power of AI in discovering complex vulnerabilities, emphasizing the need for defenders to stay ahead of AI-driven exploit development. Organizations should prioritize patching known vulnerabilities and monitoring for emerging threats that leverage AI for attack automation and discovery.