Claude Found 62 Chrome Flaws — and a Way Into a Locked Android Phone

October 29 — On 27 October Anthropic published a research report saying that, using an unreleased internal Claude research model, it found vulnerabilities in Chrome, Safari, Android, Windows and Linux and chained several of them into five working attack chains. All the flaws were reported to vendors under coordinated disclosure and have been fixed.

Chrome drew the most attention: Anthropic’s reports to Google produced 62 critical or high-severity CVEs, including 13 sandbox escapes and 21 that could take control of the web renderer process. The fixes shipped with Chrome 156.

The team says that after an initial prompt from researchers, Claude located vulnerabilities on its own and wrote exploit code; its Chrome proof of concept could open the calculator app on a default macOS installation within seconds of a page loading.

In Safari, the flaw chain Claude found could bypass the same-origin policy, giving a malicious site a chance to read data from accounts the user was logged into; Apple confirmed and shipped a fix the same day. The Android attack requires physical access to the device and can pull photos and other personal data from a locked Pixel 9 over USB; Google says it has addressed the issue.

On Windows, Claude focused on a flaw tracked as CVE-2026-33096, rated 7.5, which lets an attacker crash a server responding to HTTP/3 requests without authentication or user interaction; Microsoft patched it in April 2026.

The most severe was the Linux flaw CVE-2026-98432, which affects servers running multipath TCP listeners: an attacker can send a packet and obtain a root shell without credentials. Anthropic’s verification took 53 minutes — 48 to leak a kernel pointer and 5 to execute commands.

Anthropic published five attack chains that string together multiple flaws, configuration weaknesses or race conditions to achieve data theft, system crashes or remote control:

1. Chrome: running code outside the sandbox

The attack starts with a V8 JavaScript engine flaw, then bypasses Chrome’s memory sandbox, exploits a CacheStorage race condition and a use-after-free in FedCM, and finally executes arbitrary code outside the sandbox.

2. Safari: stealing sensitive data with one click

The model built a “one-click” attack chain that bypasses the same-origin policy, letting a malicious page reach data from other sites that should be isolated — browser history, cookies, and emails and banking details while logged in.

3. Android: pulling photos from a locked phone

This chain targets a locked, unlocked-but-not-yet-opened Pixel 9, exploiting a USB-related flaw to extract photos and other personal information while the device is locked. Even with the screen locked, a phone may still leak local media and personal data.

4. Windows: crashing a server remotely, again and again

Claude found an out-of-bounds read in Windows’ QUIC kernel implementation that can be triggered remotely to crash a server repeatedly.

5. Linux: root with zero clicks

The team says Claude found a zero-click remote code execution flaw in the Linux kernel’s network stack that yields root privileges in about 53 minutes.