Anthropic Says an Unreleased Claude Model Built Working Chrome, Safari and Pixel 9 Exploits

Anthropic Says an Unreleased Claude Model Built Working Chrome, Safari and Pixel 9 Exploits
| The Desk Media Staff
#AI

Anthropic says an unreleased, internal Claude research model found and chained security flaws into working exploits against Chrome, Safari, a locked Google Pixel 9, Windows and Linux. The company’s Frontier Red Team detailed five attack chains in an October 27 research post, and says every flaw was reported to the affected vendor under coordinated disclosure and has been fixed.

The Chrome chain: one page load, code outside the sandbox

The headline demo strings together four Chrome bugs: memory corruption in V8, Chrome’s JavaScript engine; a second flaw that breaks out of V8’s own memory sandbox and takes over the renderer; a race condition in CacheStorage that leaks the layout of the more privileged browser process; and a use-after-free in FedCM, Chrome’s federated sign-in feature, that runs code outside the browser sandbox. Anthropic’s proof of concept opened Calculator on a Mac running stock Chrome within seconds of a page loading, with no further clicks.

Anthropic says Google assigned 62 CVEs from the work, all rated critical or high and all patched as of Chrome 156, including 13 sandbox escapes. The Hacker News notes Chrome 156 shipped October 20 and that Google’s release notes credit “Xinyang Ge of Anthropic, assisted by Claude” on specific fixes, though not on all 62.

Safari and the locked Pixel 9

In Safari, the model built a data-only chain through a JavaScriptCore use-after-free that switched off the same-origin policy, letting a malicious page read data from sites the user is signed in to, such as email or a bank. Anthropic says Apple acknowledged the report the same day; The Hacker News ties the fix to iOS and iPadOS 26.5.2 in June.

On Android, the model chained three flaws in USB handling and the device-to-device transfer and pairing flow to copy photos and other data off a locked Pixel 9 without unlocking it. It needs physical access over USB. Anthropic says Google has addressed it, but no public CVE is cited. The other two chains were a remote crash of Windows servers answering HTTP/3 (CVE-2026-33096, patched in April) and a zero-click root exploit for Linux servers running a multipath TCP listener (CVE-2026-98432).

What it means

None of these were seen in real attacks; they were built in the lab after prompting. Anthropic says the model needed only “initial prompting” and “little human involvement,” but it hasn’t named the model or broken down what people did at each step, and the results haven’t been independently reproduced, as Cult of Mac points out. It lands weeks after AI security startup XBOW collected Google’s top Chrome full-chain bounty for an exploit it built by directing AI agents. For users, the fix is simple: make sure Chrome is on version 156 or later, relaunch it, and keep your iPhone and Android phone updated.