Chrome 156, promoted to the stable channel on October 20, 2026, carries fixes for bugs that an unreleased Anthropic research model helped find and chain into a working attack on the browser. Anthropic’s Frontier Red Team says that, after initial prompting and with little human involvement, the model turned memory-safety flaws in Chrome into a one-click code-execution exploit, and it also reports a remote denial-of-service flaw in Windows. The Hacker News reports that Anthropic sent every flaw to the affected vendor first and that all were patched.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The accounts of what was run, and where, come from Anthropic itself. The Hacker News says the exploits were built in the lab and were not seen in any real attack, and none of the primary records read for this report says otherwise.
Inside Anthropic’s Frontier Red Team account
The team’s research post lists Nicholas Carlini, David Dworken, Xinyang Ge, Ben Morris, Milad Nasr, Chris Rohlf and Luna Tong as contributors. It describes an internal research model that is not available to the public, started with “initial prompting” that the post does not reproduce. For the Windows case, the post says the model was asked to reverse-engineer a binary with tools such as Ghidra, write an annotated C reproduction, check that reproduction against the original, and then hunt for vulnerabilities, including the higher-risk kind.
The post also describes a platform that runs many scanning agents in parallel with different strategies and automated variant analysis. It does not lay out a sealed test environment, and it does not say how many of the reported bugs were previously unknown. The model itself goes unnamed.
The post also mentions local privilege-escalation bugs in OpenBSD, FreeBSD and Linux, more sandbox escapes and web-application flaws, but gives no detail on them. That leaves five platform cases that can be checked against public records, and the checks come out unevenly: the Chrome and Safari fixes are visible in vendor release notes, while the Android item has no public trace that The Hacker News could find.
The Chrome chain and the Safari credit
For Chrome, the post reports a one-click remote-code-execution chain demonstrated as a proof of concept on macOS, plus 62 CVEs rated critical or high, among them 13 sandbox escapes and 21 renderer-compromise bugs, all patched as of Chrome 156. The Hacker News breaks the chain into four flaws: V8 memory corruption, a sandbox escape, a CacheStorage race condition and a FedCM use-after-free. Google’s Chrome 156 stable announcement confirms the October 20 promotion for Windows, Mac and Linux; the portion of the page that could be read gave no build numbers or credits, and The Hacker News says Google credits “Xinyang Ge of Anthropic, assisted by Claude” for particular fixes, not all 62.
Safari was a smaller result. The post says chained flaws gave read and write access to browser memory and defeated the same-origin policy, with no code execution. Apple’s security notes for iOS and iPadOS 26.5.2, released June 29, credit one WebKit use-after-free, CVE-2026-43715, to “Milad Nasr and Nicholas Carlini with Claude, Anthropic.”
Windows and Linux records that do not line up
The Windows finding is a denial of service, not code execution. Anthropic describes an out-of-bounds read in the kernel’s QUIC implementation, tracked as CVE-2026-33096, and estimates several million exposed servers. The National Vulnerability Database entry for that identifier reads differently: an out-of-bounds read in Windows HTTP.sys that lets an unauthorized attacker deny service over a network, scored 7.5 by Microsoft and published April 14, 2026. CISA enrichment data on that entry lists exploitation as “none.” The Hacker News makes the same observation about the mismatch and adds that the flaw is absent from CISA’s known-exploited catalog.
Linux shows a similar gap. The post calls its zero-click finding a race-condition use-after-free in multipath TCP code, tracked as CVE-2026-98432, and says a proof of concept needs about 48 minutes to leak a kernel pointer and roughly five more to reach command execution. Tenable’s record for that CVE, scored 9.8 and published October 15, describes a use-after-free in the IPv4 TCP stack tied to how socket option memory is freed, with no mention of multipath TCP. No source read for this report explains the difference.
Disclosure terms and what the post does not say
Reports followed Anthropic’s coordinated disclosure policy: 90 days for a vendor to patch, then 45 more before details beyond a public advisory are discussed. Apple, by the post’s account, acknowledged the Safari report the same day and shipped a fix. The Android result, copying data from a locked Pixel 9 over USB, is described as addressed by Google, though The Hacker News found no public record of it.
The post states: “Any vulnerabilities in these products could affect billions of users.” Anthropic, according to The Hacker News, presents the results as something models can do with little human involvement. What the sources do not supply is how many person-hours of steering sat behind each chain, whether any of the 62 Chrome bugs were already known to the vendor, or why the Windows and Linux identifiers describe different code than the post does.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
