Claude Found 62 Critical and High-Severity Chrome Flaws and Built a One-Click Exploit

On October 27, 2026, Anthropic’s Frontier Red Team published results from months of using an unreleased, internal Claude research model to hunt for vulnerabilities in some of the most widely used software in the world. The post walks through five attack chains that led to remote code execution and other critical impacts with little to no user interaction.

62 Chrome flaws

Anthropic says it reported its Chrome findings to Google, and 62 CVEs have been assigned and patched as of Chrome 156, all rated critical or high severity. Among them are 13 sandbox escapes and 21 bugs that could have been used to compromise Chrome’s renderer process. Google’s own Chrome release notes for the October 27 stable update credit several critical and high-severity fixes to Anthropic researcher Xinyang Ge, “assisted by Claude.”

A one-click exploit

After initial prompting, Claude wrote a full exploit chain that ran code as the user outside Chrome’s sandbox. It combined four bugs: memory corruption in Chrome’s V8 JavaScript engine, a second flaw to break out of V8’s memory sandbox, a race condition in CacheStorage that leaked the browser process’s memory layout, and a use-after-free in FedCM, Chrome’s federated sign-in feature. Anthropic’s proof of concept opened the Calculator app on a stock Mac within seconds of loading a web page, with no other clicks.

Beyond Chrome

The same work produced:

• A one-click Safari chain that bypassed the same-origin policy, which could expose history, cookies and logged-in accounts. Apple has shipped a fix.
• An Android lock screen bypass, tested on a Pixel 9, that pulled photos from a locked phone over USB. Google has addressed it.
• A Windows remote crash in the kernel’s QUIC (HTTP/3) code, now CVE-2026-33096, resolved by Microsoft.
• A zero-click Linux kernel exploit that gave root on servers with a multipath TCP listener, CVE-2026-98432, patched upstream and backported.

All of it went to vendors under Anthropic’s coordinated disclosure policy, which gives developers 90 days to patch.

Why it matters

Anthropic says finding and chaining multiple bugs into a working exploit used to be the work of a few specialist teams, and models can now do it with little human involvement. Its advice to defenders is to scan their own code, including at pull request time. For everyone else, the takeaway is simpler: keep Chrome, your phone and your operating system updated.