Korea’s Euclidsoft Says Google Paid It $250,000 for a Chrome Full-Chain Exploit
Korean security firm Euclidsoft says it has received a $250,000 payout from Google’s Vulnerability Reward Program for a Chrome “full-chain” exploit, the top single-report prize Google offers for the browser. The company, which counts display and lighting maker Fine Technics as an investor, announced the award on October 29, according to The Asia Business Daily and Newspim.
What Euclidsoft is claiming
According to the company, it is only the second team worldwide to collect a Chrome full-chain reward, after AI security startup XBOW, and the first Korean company or institution to do so. Euclidsoft also says the payout is the largest single VRP reward Google has handed out this year and the second-largest in the program’s history. Those rankings come from Euclidsoft’s own announcement; Google hasn’t published a matching statement, and neither company has released the bugs, a write-up or CVE numbers for this chain.
A full chain is the hardest category Chrome’s bounty program pays for. Instead of a single bug, it’s a series of flaws stitched together so that simply visiting a web page leads to code running outside Chrome’s sandbox, the layered isolation that’s supposed to contain anything a malicious site manages to do inside a tab.
The XBOW precedent
The only other public example came earlier this month. XBOW detailed a chain combining a V8 compiler bug, an animated-WebP decoder flaw and a memory-safety bug in Chrome’s Crashpad crash handler, which together turned JavaScript in an ordinary tab into code execution on a Windows host. XBOW says it built the working exploit in six days by directing AI agents, and that it was the first $250,000 full-chain award under VRP rules Google introduced in April 2026. The Hacker News reports Google confirmed and fixed all three bugs, and that the program caps full-chain awards at four a year.
Euclidsoft dates Chrome’s full-chain reward program to 2023, while XBOW ties the $250,000 tier to the 2026 rule change, so the “first since” framing depends on which version of the program you count.
What it means for Chrome users
Google typically pays these bounties after the underlying bugs are fixed, but with no advisory yet tied to Euclidsoft’s chain, there’s no specific version to check. The practical advice is the usual one: let Chrome update and actually relaunch it, since patches don’t take effect until the browser restarts. The bigger story is the pace. Two top-tier Chrome chains landing within weeks of each other, one built largely by AI agents, suggests the bar for this kind of attack is dropping.