Claude AI Builds One-Click Chrome and Zero-Click Linux Exploit Chains, Bypasses Android Lock Screen

Anthropic’s Frontier Red Team says an unreleased Claude research model wrote working exploit chains for Chrome, Safari, Android, Windows, and Linux.

The company shared the details in on research post on October 27, 2026. These were lab tests and not real-world incidents. Anthropic reported every bug to the vendor first, and the vendor released fixes.

Chrome Falls to a One-Click Chain

The Chrome exploit is the most detailed. After a first prompt, Claude wrote a chain that runs code outside the browser sandbox. The test launched the Calculator app on a default Chrome install on macOS within seconds of a page loading.

The chain used four bugs. The first corrupted memory in V8, Chrome’s JavaScript engine. The second broke out of V8’s memory sandbox, beat ASLR, and took over the renderer process. A race condition in CacheStorage then leaked the layout of the more powerful browser process. A use-after-free bug in FedCM, Chrome’s sign-in feature, finished the escape.

Anthropic says Google assigned 62 CVEs, all rated high or critical, including 13 sandbox escapes. All are fixed in Chrome 156. Google’s Chrome 156 release notes from October 20 credit “Xinyang Ge (Anthropic), assisted by Claude” for several fixes, but not for all 62.

Safari and Android Bypasses

In Safari, Claude broke the same-origin policy, the rule that keeps one website from reading another. The chain started with a use-after-free bug in JavaScriptCore. It then got around WebKit’s Gigacage defense and used a flaw in the sandbox’s IPC mechanism to read history, cookies, and sessions from disk. Anthropic notes this chain never needed code execution. A hostile page could read a signed-in email or bank account. Apple confirmed the report the same day and shipped a fix.

The Android case needs physical access. Claude pulled photos and other data from a locked Google Pixel 9 over USB. It did this by linking three flaws that skipped the USB data block, the pairing authorization, and the six-digit code check. A fallback path then sent raw file bytes past a hardcoded block. Anthropic says Google fixed it. Our earlier story on an Android lock screen bypass through Driving Mode shows how often these gaps appear.

Windows Crash Bug and the CVE Mismatch

Claude also found a remote crash bug in Windows, which Anthropic describes as an out-of-bounds read in the kernel’s QUIC code. It reached the bug by reverse engineering a Windows binary with Ghidra. A few packets could crash and restart a server that answers HTTP/3, and repeating them keeps it down. Anthropic believes several million such servers face the internet.

Public records tell a slightly different story. The NVD entry for CVE-2026-33096 names the Windows HTTP.sys driver and not QUIC. It carries a 7.5 score and a fix from April 2026. Rapid7 lists the same details. The NVD entry does not name a finder.

Zero-Click Linux Root Access

The Linux chain is the most serious. Claude wrote an exploit that gives a remote attacker root access on servers running a multipath TCP listener. It needs no login and no user action. It works in two steps. First, it leaks a kernel pointer to defeat KASLR. Then it reuses the same race condition bug to overwrite a callback pointer and run a shell command.

A lost race only fails the handshake and does not crash the machine, so an attacker can try again and again. In the test, the leak took 48 minutes, and the shell took five more. Anthropic ties this to CVE-2026-98432. Its Tenable listing rates it 9.8 and describes an IPv4 TCP use-after-free fix, with no mention of multipath TCP. The link between the two rests on Anthropic’s post.

Anthropic says it found so many bugs by running many scanning agents in parallel and checking each finding with a standard process. It also urges teams to scan code at pull request time, and it released a security guidance plugin for Claude Code. Its expanded Cyber Verification Program gives approved security staff access to its strongest models.

The same tools can help attackers, so patching speed is critical. Update Chrome to version 156 or later, install current Apple, Android, and Windows updates, and patch Linux kernels. Teams can also read our report on Claude Security’s continuous repository scans and our earlier look at chained Claude.ai flaws.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Claude AI Builds One-Click Chrome and Zero-Click Linux Exploit Chains, Bypasses Android Lock Screen appeared first on Cyber Security News.