AI Writes Full Chrome 149 Exploit: GPT-5.6 Sol Ultra Chains V8 Flaws to macOS Code Exec

A security researcher has reported that the GPT-5.6 Sol Ultra model successfully produced a working Chrome renderer exploit against Chrome version 149.0.7827.201 by leveraging V8 version 14.9.207.35, underscoring a new inflection point in automated exploit development.

In a controlled research benchmark, Sol Ultra was provided the relevant V8 source tree, patch commits, and a sandbox-enabled d8 JavaScript shell and was tasked with three specific milestones: construct object-address and forged-object primitives, gain arbitrary memory access inside the V8 sandbox, and escape the renderer sandbox to execute a native command.

Where other advanced models stalled at intermediate stages, Hacktron’s evaluation reports that Sol Ultra completed the entire exploit chain, ultimately launching the macOS Calculator from a sandboxed Chrome renderer process.

AI Writes Full Chrome 149 Exploit

The experiment demonstrates how a capable large model can stitch together multiple, previously patched vulnerabilities across JavaScript engine and WebAssembly infrastructure into a coherent end-to-end chain.

The initial foothold in the exploit was a type-confusion bug in the Maglev compiler (tracked as bug 523884658) caused by an inlined ArrayIterator.prototype.next() optimization that failed to validate the Map of the underlying array after optimization.

By manipulating sloppy-mode Function.arguments behavior to alter an array’s element representation, the exploit induced misinterpretation of values as either object references or floating-point numbers.

That addrof/fakeobj primitive allowed the attacker to construct forged JavaScript array headers and escalate to controlled read/write within V8’s pointer-compression “cage,” here described as a 444‑GB address region, before expanding access into the engine’s larger 111‑TB sandbox.

The sandbox escape relied on a separate flaw in SlicedString traversal that mishandled signed integers; by corrupting string metadata and triggering the appropriate error path, the chain leaked native memory addresses tied to the Chrome framework, WebRTC allocations, libc, the stack, and the V8 sandbox.

While other evaluated models such as Grok 4.5 and GPT-5.6 Sol Medium reached partial information-leak stages, they reportedly stalled before producing reliable arbitrary read/write primitives; Sol Ultra alone bridged that gap.

For native code execution the exploit abused a use-after-free in V8’s NativeModule background compilation: a stale compiler operation interacted with attacker-controlled data after a freed NativeModule allocation was reclaimed.

Although this condition did not produce a full arbitrary native-write primitive, the exploit achieved a constrained bitwise OR primitive on chosen native memory locations.

The researchers then used that limited write to redirect the WebAssembly code-pointer table base into controlled memory, preserve a legitimate engine-generated signature in a WebAssembly entry, replace the entry point with a Chrome Framework register-loading gadget, and invoke posix_spawnp to open Calculator, completing the end-to-end chain.

Operationally, Sol Ultra’s run was large-scale: processing roughly 2.1 billion input tokens over three days, producing some 666 million output tokens across 14,062 requests, and employing 747 sub-agents that consumed about 70% of token usage; the total reported cost was roughly $1,596.89.

The model also used context compaction techniques, 333 root-agent compactions that reduced active context by about 92.67%, and relied on saved debugger outputs, Markdown notes, proof scripts, and sub-agent findings to reconstruct technical context during development.

Although the work targeted known, patched vulnerabilities within a controlled environment, the result raises urgent defensive implications: as AI systems increasingly automate code analysis, patch diffing, PoC generation, debugging, and exploit chain integration, the time and effort required to produce reliable exploits may shrink.

Organizations should respond by accelerating patch deployment, implementing stronger browser isolation and least-privilege measures, monitoring vulnerability disclosures closely, and beefing up detection engineering to counter a lower barrier to exploit development.