Anthropic says an unreleased model built five exploit chains across Chrome, Safari, Android, Windows and Linux, yielding 62 Chrome CVEs

What the five chains contain

For Chrome the model chained a V8 heap corruption, a V8 memory-sandbox escape with ASLR bypass, a CacheStorage race that leaked the browser process memory layout, and a FedCM use-after-free into a one-click sandbox escape on macOS. Google rated all 62 resulting CVEs critical or high (including 13 sandbox escapes and 21 renderer compromises) and fixed them in Chrome 156.

For Safari it moved from a JavaScriptCore TypedArray use-after-free through a Gigacage bypass to a WebContent IPC weakness, which Apple acknowledged the same day and patched. For Android it chained three bugs to extract photos from a locked Pixel 9 over USB. Each path requires little or no user interaction and defeats the browser and device defence layers in sequence.

Two server-side chains and the limits of verification

For Windows, binary analysis with Ghidra found an out-of-bounds read in the kernel QUIC implementation that allows remote crashes of HTTP/3 servers, fixed as CVE-2026-33096. For Linux, against servers with a multipath-TCP listener, a race in the networking stack leaked a kernel pointer in 48 minutes and yielded a root shell five minutes later, fixed and backported as CVE-2026-98432.

Observers note, however, that the NVD entry for CVE-2026-33096 names HTTP.sys and Tenable describes CVE-2026-98432 as an IPv4 TCP use-after-free without mentioning multipath TCP, so the details of the chains rest on the Anthropic account. No exploit code was released and no independent reproduction has been reported. The significance therefore lies less in the severity of any single bug than in an unreleased model carrying the whole process of finding and chaining vulnerabilities.

Expanding access for defenders

The company released a security-guidance plugin for Claude Code and expanded its Cyber Verification Program, which relaxes blocking classifiers for vetted professionals, to cover Opus 5.5, Sonnet 5.5 and Mythos 5.1. Publishing offensive findings while channelling access to vetted defenders runs in the same direction as Google's Fairwind Program, making who may use frontier models' offensive capabilities, and on what terms, the central design question of each company's release.