Anthropic says an unreleased, internal Claude research model found vulnerabilities in Chrome, Safari, Android, Windows and Linux, then combined them into five working exploit chains. The company published the findings on October 27, 2026. It says the affected vendors have fixed the reported flaws.
In Chrome, Claude built a chain that could run an attacker’s code outside the browser’s sandbox after a user opened a malicious page, Anthropic says. Its demonstration launched the Calculator app on a Mac running Chrome with its default settings, within seconds of the page loading and without further interaction. The chain crossed several layers of browser protection, ending with a flaw in Chrome’s federated sign-in feature.
Anthropic says it reported its Chrome findings to Google. As of Chrome 156, 62 assigned vulnerabilities had been patched, all rated high or critical severity. The company says 13 were sandbox escapes and 21 could have been used to compromise Chrome’s renderer process.
Read nextAnthropic assesses Claude Mythos 5’s actions in UK cyber testOther chains reached browser data and locked phones
Anthropic says a separate Safari chain let a website bypass restrictions that normally prevent it from reading another site’s data. The exploit could access browsing history and cookies, and read responses to requests made using a user’s existing sign-ins. Apple acknowledged Anthropic’s report on the day it was submitted and has made a fix available, according to the company.
On a Google Pixel 9, Claude combined flaws that could let someone extract photos and other personal information from a stolen Android phone without unlocking it, Anthropic says. The attack used a USB connection and bypassed checks in the device transfer process. Google has addressed the issue.
Server flaws allowed crashes and remote commands
Claude also identified a Windows flaw that could let an attacker repeatedly crash a machine responding to HTTP/3 requests through Windows’ native implementation, Anthropic says. Microsoft resolved the issue and assigned it CVE-2026-33096. In Linux, Anthropic says an attacker could send packets to a server with a multipath TCP listener and run commands as root without credentials or user interaction. Its demonstration took 48 minutes to reveal a kernel address and another five minutes to run a command.
Anthropic says it reported each vulnerability through its coordinated disclosure process, which gives vendors 90 days to patch and a further 45 days before it discusses details beyond a public advisory. The Linux flaw, CVE-2026-98432, has been patched upstream and backported to all maintained stable kernel branches.
