Unreleased Claude model built a one-click Chrome exploit

Anthropic says an unreleased internal research model found the bugs behind 62 Chrome CVEs, all rated critical or high and all patched as of Chrome 156. They came out of work that produced five working attack chains against browsers and operating systems, described in an October 27 post on Anthropic’s research blog. If your team runs Chrome, Linux servers with a multipath TCP listener, or Windows servers that answer HTTP/3 through the native stack, the fixes for the disclosed bugs have already shipped, so the job is to confirm you have them installed.

The Chrome chain needed one click and nothing else. On a stock, default-configuration Chrome on macOS, the proof of concept escaped the browser sandbox and launched Calculator within seconds of the page loading.

What was patched, and where

• Chrome: one-click code execution as the user, outside the sandbox. Of the 62 CVEs fixed as of Chrome 156, 13 are sandbox escapes and 21 could have been used to compromise the renderer, the process that runs web content.
• Safari: a one-click chain that got around the same-origin policy, the rule that keeps one site from reading another site’s data. It could reach history, cookies and signed-in sessions such as email or banking. Apple acknowledged the report the day it arrived, and the fix is available to users.
• Android: photos and other personal data pulled from a locked, stolen phone over USB, tested on a Google Pixel 9. Google has addressed it.
• Windows: a remote crash of any machine serving HTTP/3 through the native Windows implementation, caused by an out-of-bounds read in the kernel’s QUIC code. Microsoft fixed it as CVE-2026-33096. Anthropic estimates there are likely several million such servers on the internet.
• Linux: zero-click remote code execution as root on servers with a multipath TCP listener, with no credentials needed. The bug, CVE-2026-98432, was patched upstream and backported to all maintained stable kernel branches.

Anthropic gives each vendor 90 days to patch under its coordinated disclosure policy, then waits another 45 days before discussing anything beyond the public advisory. The post also lists other findings with fewer details: local privilege escalation bugs in OpenBSD, FreeBSD and Linux, sandbox escapes in popular sandboxing infrastructure, and vulnerabilities in important web applications.

Not every chain relied on classic code execution. In Safari, Anthropic says several of the weaknesses were intended behaviours that became exploitable only in combination. The Windows bug was found by reverse-engineering a binary rather than reading source code, and Anthropic says finding it was the hard part.

The scanning advice behind it

Anthropic singles out two lessons. The first is that running more scanners, and more kinds of them, finds more bugs. Its platform runs large numbers of scanning agents in parallel, scores each one by how many additional vulnerabilities it adds, and tracks coverage so the whole codebase gets processed. The strategies range from checking single functions to asking whether an app breaks its own documented threat model. Every confirmed finding then gets automated variant analysis, a search for the same flaw elsewhere, and all findings go through one shared verification and risk-rating pipeline.

The second lesson is about new code. Clearing the existing backlog is only half the problem, so Anthropic recommends scanning at pull-request time. It built that into its own development process as a Claude Code plugin and has released the plugin publicly.

For security teams that want the stronger models, Anthropic expanded its Cyber Verification Program on October 6. It now has three access tiers, offers reduced blocking classifiers to qualifying security professionals, and every tier includes Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1.

The same vendors as in April

Every vendor in this post was already a partner in Project Glasswing, the effort Anthropic announced on April 7 with Apple, Google, Microsoft, the Linux Foundation and others to secure critical software using Claude Mythos Preview. Back then, Anthropic highlighted a browser exploit in which Mythos Preview chained four vulnerabilities to escape both the renderer and the operating system sandboxes. The Chrome chain described today also links four bugs, and this time it comes with a vendor count of 62 patched CVEs.

Anthropic’s advice to defenders is unchanged: “scanning your own code is more important than ever.”