LLMs Now Cut Chrome Exploit Development to Pocket Change
Low-cost LLMs have crossed from code assistance into exploit construction. The standard response is to treat browser zero-days as specialist work, but this report shows a patient operator can turn public V8 details into a working chain for embedded Chromium builds at commodity cost.
Hacktron CTO Mohan Pedhapati said Anthropic Opus 4.6 helped him build a full exploit chain against Chrome's V8 engine in Chrome 138, which is bundled into current Discord builds. He said the effort took about a week, 2.3 billion tokens, and $2,283 in API spend, and that the same V8 out-of-bounds issue came from Chrome 146.
The risk is not just one exploit. It is that embedded Chromium apps inherit browser-class exposure, and accessible models lower the skill and time needed to weaponize public research against them.