# Claude Chained 4 Bugs Into a Chrome Exploit

> Anthropic's model found exploit chains in Chrome, Safari, Android, Windows and Linux. The 62 Chrome CVEs and what it means.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-27
- Canonical (HTML): https://cellcog.ai/blog/claude-finds-chrome-safari-exploits/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- Anthropic says an unreleased internal research model found and exploited critical vulnerabilities in Chrome, Safari, Android, Windows and Linux, and published five attack chains on October 27, 2026.
- Chrome alone: 62 CVEs assigned and patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes.
- The Chrome chain ran four discovered bugs together to launch an app on stock macOS Chrome seconds after a page loaded, with no further clicks.
- The Linux chain was zero-click root over the network: 48 minutes to leak a kernel pointer, five more to a root shell. Patched as CVE-2026-98432.
- Anthropic's conclusion for defenders: chaining exploits used to need specialist teams, models can now do it with little human involvement, so scan your own code first.

## At a glance

- **What did Anthropic publish?** Five attack chains its internal research model found in widely used software: one-click remote code execution in Chrome, a Safari same-origin bypass, an Android lock-screen bypass, a remote Windows crash, and zero-click root on Linux.
- **Are the holes fixed?** Anthropic says each was reported under coordinated disclosure. Chrome fixes landed by version 156, Apple fixed the Safari chain, Google addressed the Android issue, and the Windows and Linux bugs have CVEs and patches.
- **Why does it matter beyond security teams?** Finding one bug is common; chaining several into a working exploit was specialist work. Anthropic says a model now does that with little human involvement and produces an exploit anyone can run.

**Anthropic published five attack chains on October 27, 2026 that it says an unreleased internal research model found and exploited in Chrome, Safari, Android, Windows and Linux.** In its words, the model found "critical vulnerabilities in some of the world's most widely used software", and the chains "led to remote code execution and other critical impacts with little to no user interaction."

Everything was reported under coordinated disclosure: vendors get 90 days to patch, plus 45 more before Anthropic discusses detail beyond a public advisory. The fixes are out. This page is read from [Anthropic's post](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude), published at 18:15 UTC.

## The five chains

![Animated scene: an arrow leaves a web page and breaks through four walls labelled V8 heap, V8 sandbox, process sandbox and FedCM, each cracking in turn, ending at a calculator that lights up](https://cellcog.ai/blog/media/claude-finds-chrome-safari-exploits/chain.svg)
*Four separate discoveries, used in sequence to get outside the browser.*

*Table: The five attack chains Anthropic published (anthropic.com, October 27, 2026)*

| Target | What the chain does | Status |
|---|---|---|
| Chrome | Four bugs chained to run code outside the sandbox; a stock macOS Chrome launches Calculator seconds after loading a page, no further clicks | 62 CVEs assigned, patched as of [Chrome 156](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html) |
| Safari | Any site's JavaScript bypasses the same-origin policy and reads history, cookies and other origins' responses | Apple acknowledged the same day; [fix shipped](https://support.apple.com/en-us/127594) |
| Android | Pulls photos and personal data off a locked phone over USB, tested on a Pixel 9 | Addressed by Google |
| Windows | Remotely crashes any machine serving HTTP/3 on the native stack, repeatedly | [CVE-2026-33096](https://nvd.nist.gov/vuln/detail/cve-2026-33096), resolved |
| Linux | Zero-click root over the network via a race in the multipath TCP path | [CVE-2026-98432](https://www.tenable.com/cve/CVE-2026-98432), patched upstream |

The Chrome numbers are the headline: 62 CVEs, "all of them rated critical or high severity. Among them are 13 sandbox escapes and 21 vulnerabilities that could have been used to compromise the renderer."

## Why chaining is the part that matters

Finding one memory bug is routine work. The Chrome chain stacked four separate discoveries: corrupt V8's heap, break out of V8's memory sandbox and defeat ASLR, win a race in CacheStorage to learn the browser process's memory layout, then a use-after-free in FedCM to execute code outside the sandbox.

The Safari chain is stranger and arguably more interesting. It never executes attacker code at all. Anthropic calls it "a data-only attack", using read and write access to the browser's memory to flip a security flag, change an object size and change a URL. Its note on how the pieces fit: "Several of the weaknesses are not vulnerabilities on their own but intended behaviors that become exploitable when combined."

The Linux one is the most alarming to operate against, because it needs nothing from the victim. In Anthropic's proof of concept the attack takes 48 minutes to leak a kernel pointer and another five to run a shell command as root, and a lost race just fails the handshake instead of crashing the machine, so an attacker can retry forever.

## How Anthropic ran it

Two method notes in the post are worth more than the exploits to anyone building security tooling.

- **Many scanners, measured against each other.** Anthropic built a platform that runs scanning agents in parallel, scores each by how many extra vulnerabilities it contributes, and tracks coverage so the whole codebase gets processed. The strategies range from "is there a vulnerability in this function?" to "does anything in this app bypass its documented threat model?"
- **Reverse engineering from a binary.** For the Windows bug, Anthropic handed the model the executable and had it drive Ghidra, write an annotated C program reproducing the behaviour, check the reproduction against the binary, then hunt for bugs in its own reconstruction.

On prevention, its line is that a backlog is only half the problem: "the other half is cutting the rate at which new vulnerabilities enter the codebase", which it recommends doing by scanning at pull-request time, with a [Claude Code plugin](https://github.com/anthropics/claude-code/tree/main/plugins/security-guidance) it has released publicly.

## What it means if you run agents

Anthropic's own framing: "Frontier models have the ability to discover and combine multiple vulnerabilities into a working exploit. These skills have historically been the domain of few specialist teams." Its advice is one line, "scanning your own code is more important than ever", and its [Cyber Verification Program](https://cellcog.ai/blog/anthropic-cyber-verification-program/) is how vetted defenders get the stronger models.

Read with [the Mythos 5 incident](https://cellcog.ai/blog/claude-mythos-5-aisi-incident/), the pattern for anyone deploying agents is the same one we keep arriving at: the boundary has to sit outside the model. An agent gets the access its job needs and nothing more, and every command it sends into your systems is classified and gated before it runs, not judged by what the model says it intends to do.

## What to watch

- **The 45-day window.** Anthropic says it will discuss details beyond the public advisories once it closes.
- **Whether the model ships.** It is unreleased and internal today; the Cyber Verification Program is the route that would widen access.
- **Attackers running the same play.** The same scanning-in-parallel method works for anyone with model access and a target.

## FAQ

**Which model found these?**

An unreleased, internal research model, in Anthropic's words. The post does not name a public Claude version as the one that produced the chains.

**How many Chrome vulnerabilities were there?**

62 CVEs assigned and patched as of Chrome 156, all critical or high severity, including 13 sandbox escapes and 21 that could have compromised the renderer.

**What is the Safari chain, in plain terms?**

Any site's JavaScript could bypass the same-origin policy, reach Safari history, cookies and session data, and send authenticated requests to other domains. Anthropic calls it a data-only attack that never runs attacker code.

**How long does the Linux exploit take?**

In Anthropic's proof of concept, 48 minutes to leak a kernel pointer and five more minutes to reach a root shell, with no credentials or user interaction.

**What does Anthropic tell defenders to do?**

Scan your own code, and scan at pull-request time rather than only clearing a backlog. It released a Claude Code plugin with its security guidance, and its Cyber Verification Program gives vetted professionals access to its stronger cyber models.

## Related

- [Anthropic Cyber Verification Program: Tiers and Access](https://cellcog.ai/blog/anthropic-cyber-verification-program/index.md)
- [Four Times Claude Left the Sandbox: Anthropic's Alignment Assessment, Explained](https://cellcog.ai/blog/claude-cybersecurity-incidents/index.md)
- [Least Privilege for AI Agents: A Practical Access Model](https://cellcog.ai/blog/least-privilege-for-ai-agents/index.md)
- [Best Super Agents, Ranked With Receipts](https://cellcog.ai/blog/best-super-agents/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/claude-finds-chrome-safari-exploits/. Try CellCog free, no credit card needed: https://cellcog.ai/signup