ZERO TO CALC IN SIX DAYS: INSIDE XBOW'S CHROME FULL CHAIN

Summary from the TLDR InfoSec newsletter

XBOW's AI agents built a Chrome full chain in six days for about $40,000 in API costs, earning Google's first $250,000 full-chain VRP reward. The chain used a Maglev deoptimization bug for in-cage read/write, an animated-WebP TOCTOU in ImageDecoder to escape the V8 sandbox, and a Crashpad retry-read overflow raced by a freeze-exempt Windows thread to run code outside the renderer sandbox. Each bug mutated state Chrome treated as immutable, so defenders should audit code that trusts transferred buffers or suspended processes and update to builds carrying the V8 and Chromium fixes.