GPT-5.6 Sol Ultra Writes Complete Chrome Exploit With V8 Sandbox Escape

This report details a controlled research experiment where an advanced language model (GPT-5.6 Sol Ultra) autonomously produced a working Chrome renderer exploit for Chrome 149 / V8 that chained multiple vulnerabilities to achieve addrof/fakeobj primitives, arbitrary read/write within V8’s pointer-compression cage, a sandbox escape via SlicedString metadata manipulation, and native code execution via a NativeModule use-after-free leading to redirection of a WebAssembly code-pointer entry and invocation of posix_spawnp. Although developed against known, patched issues in a lab environment, the experiment highlights increasing automation and sophistication in exploit development and urges rapid patching, browser isolation, disclosure monitoring, and improved detection engineering.