Anthropic's unreleased Claude wrote working exploit chains for Chrome, Safari, Android, Windows and Linux — update Chrome to 156
Quotable summary
On 27 October 2026 Anthropic’s Frontier Red Team published five exploit chains written by an unreleased, internal Claude research model, each turning newly found bugs into real attacks with little or no user interaction: one-click code execution outside Chrome’s sandbox, a one-click Safari same-origin bypass, an Android lock-screen bypass that pulls photos off a locked phone, a remote crash of Windows HTTP/3 servers (CVE-2026-33096), and zero-click root on Linux servers with a multipath TCP listener (CVE-2026-98432). All were reported under coordinated disclosure and Anthropic says each is fixed. Google’s Chrome 156 stable release the same day carries 52 security fixes, several credited to “Xinyang Ge (Anthropic), assisted by Claude.” Action: update Chrome to 156.0.8078.73 or later and restart the browser.
What changed
| Target | What Claude built | Status per Anthropic |
|---|---|---|
| Chrome (macOS, default config) | One-click RCE outside the sandbox: V8 heap corruption, V8 sandbox escape + ASLR bypass, CacheStorage race, FedCM use-after-free | Patched as of Chrome 156 |
| Safari | One-click same-origin-policy bypass reading history, cookies and session data; data-only attack via JavaScriptCore use-after-free and a sandbox IPC flaw | Fixed by Apple |
| Android (tested on Pixel 9) | Lock-screen bypass over USB extracting photos and personal data without unlocking | Addressed by Google |
| Windows | Remote crash of any machine serving native Windows HTTP/3 via a QUIC kernel out-of-bounds read, CVE-2026-33096 | Resolved by Microsoft |
| Linux kernel | Zero-click remote root via multipath TCP race/use-after-free, CVE-2026-98432 | Patched upstream and backported to maintained stable kernels |
Chrome 156 numbers
| Item | Figure | Source |
|---|---|---|
| Stable release | 156.0.8078.73/.74 Windows and Mac, 156.0.8078.73 Linux, 27 Oct 2026 | Chrome Releases |
| Security fixes in this release | 52 | Chrome Releases |
| CVEs from Anthropic’s findings | 62, all critical or high, incl. 13 sandbox escapes and 21 renderer compromises, patched “as of Chrome 156” | Anthropic |
The two counts measure different things: Google’s 52 is one release’s fix list, while Anthropic’s 62 covers all its reported Chrome CVEs fixed up to and including 156. Not every fix in Google’s list credits Claude.
Why it matters
- Exploit development is no longer a specialist bottleneck. Anthropic says these skills “have historically been the domain of few specialist teams” and models can now do it “with little human involvement.” Patch windows get shorter for everyone, defenders and attackers alike.
- Browser patch lag is the exposure. Chrome rolls out “over the coming days/weeks.” Managed fleets should push 156 now rather than wait for auto-update.
- Check Linux servers with MPTCP enabled. The Linux bug is zero-click, and Anthropic’s proof of concept needed about 48 minutes to leak a kernel pointer and five more for a root shell. Make sure your distro kernel includes the backport.
- Windows HTTP/3 servers: Anthropic estimates “several million” listening servers could have been crashed. Confirm the CVE-2026-33096 update is installed.
- AI on both sides. Chrome 156 also credits a bug to OpenAI Codex Security, a sign that AI-found vulnerabilities are now routine in big vendors’ patch notes.
FAQ
Is my browser safe? Update Chrome to 156.0.8078.73 (Linux) or 156.0.8078.73/.74 (Windows and Mac) or later, and keep Safari current. Anthropic says Apple’s fix is already available.
Were these exploited in the wild? Neither Anthropic’s post nor Google’s release notes report in-the-wild exploitation of these bugs. Anthropic reported them under coordinated disclosure.
Which Claude model did this? Anthropic calls it an “unreleased, internal research model.” It has not named it publicly.
Can defenders get these capabilities? Anthropic points qualifying security professionals to its expanded Cyber Verification Program and recommends scanning code at pull-request time.
Sources
| Source | Role | Link |
|---|---|---|
| Anthropic | Primary: five exploit chains, CVE counts, disclosure status | Anthropic — Discovering and exploiting vulnerabilities with Claude |
| Google Chrome Releases | Primary: Chrome 156 versions, 52 fixes, credits | Chrome Releases — October 2026 |
| The Hacker News | Secondary: coverage of the chains | The Hacker News — Anthropic’s unreleased model chains flaws |
| Cybersecurity News | Secondary: Chrome chain walkthrough | Cybersecurity News — Claude builds Chrome and Linux exploit chains |