Article · AI translation
IT Home reported on October 29 that Anthropic published a research report on October 27 saying it had used an unreleased internal Claude research model to find vulnerabilities in Chrome, Safari, Android, Windows, and Linux, and chained multiple vulnerabilities into 5 attack chains that could be executed in practice. All the relevant vulnerabilities were reported to vendors and fixed through a coordinated disclosure process.
Chrome drew the most attention. Citing the blog post, IT Home reported that Anthropic’s submissions to Google resulted in 62 critical or high-severity CVEs, including 13 sandbox escape vulnerabilities and 21 vulnerabilities that could give control of the web rendering process. Fixes were released with Chrome 156.
The research team said that, after researchers provided an initial prompt, Claude independently located vulnerabilities and wrote exploit code; its Chrome proof of concept could open the Calculator app within seconds of a page loading on a default macOS installation.
For Safari, a vulnerability chain found by Claude could bypass the same-origin policy, giving a malicious website an opportunity to read data from accounts the user was logged into; Apple confirmed the issue and released a fix on the same day. The Android attack requires physical access to the device and can extract photos and other personal data over USB from a locked Pixel 9; Google said it had addressed the issue.
For Windows, Claude notably found a vulnerability tracked as CVE-2026-33096, rated 7.5, that allows an attacker to crash a server responding to HTTP/3 requests without authentication or user interaction; Microsoft released a patch in April 2026.
The most severe was the Linux vulnerability CVE-2026-98432, which targets servers running a multipath TCP listener: an attacker can obtain a root shell without credentials by sending packets. Anthropic’s validation took 53 minutes in total, with 48 minutes spent leaking a kernel pointer and 5 minutes executing commands.
Anthropic disclosed 5 attack chains that combine multiple vulnerabilities, configuration weaknesses, or race conditions to ultimately enable data theft, system crashes, or remote control:
1. Chrome: Bypass the sandbox to execute code
The attack begins with a vulnerability in the V8 JavaScript engine, then bypasses Chrome’s memory sandbox and exploits a CacheStorage race condition and a use-after-free flaw in FedCM, ultimately executing arbitrary code outside the sandbox.
2. Safari: Steal sensitive data with one click
The model constructed a “one-click” attack chain that bypasses the same-origin policy, allowing a malicious webpage to access data from other websites that should be isolated, including browser history, cookies, and sensitive information such as email and banking data when the user is logged in.
3. Android: Extract photos from a phone without unlocking it
This chain targets a locked Pixel 9 Android phone and exploits USB-related flaws to extract photos and other personal information while the device remains locked. Even when the phone is on the lock screen, local media and personal data may still be exposed.
4. Windows: Repeatedly crash a server remotely
Claude found an out-of-bounds read vulnerability in the Windows QUIC kernel implementation that can be triggered remotely to repeatedly crash a server.
5. Linux: Gain root privileges with zero clicks
The research team said Claude found a zero-click remote code execution vulnerability in the Linux kernel network stack that can grant root privileges in about 53 minutes.