Skip to content
Rush Commerce
AI & Automation2 min read

Anthropic AI exploit chains: Chrome 156 fixes 62 CVEs

Anthropic's AI model built exploit chains for Chrome, Safari, Android, Windows and Linux. Chrome 156 fixes 62 CVEs. Update every browser and device this week.

An AI model found and chained real bugs in the browsers and phones your staff use every day. Anthropic's Frontier Red Team published the work on October 27: an unreleased internal model built AI exploit chains against Chrome, Safari, Android, Windows and Linux. Google alone assigned and patched 62 Chrome CVEs. Every bug is fixed. The fix only helps you if your devices actually installed it.

What actually happened

Per Anthropic's research post:

  • Chrome (macOS): a one-click chain of four flaws, including V8 heap corruption and a FedCM use-after-free, that ran code outside the browser sandbox.
  • Chrome totals: 62 CVEs, all rated critical or high, patched as of Chrome 156. 13 are sandbox escapes.
  • Safari: a one-click chain that bypassed the same-origin policy. Apple has shipped a fix.
  • Android: a lock-screen bypass on a Pixel 9 that pulled photos off a locked phone. Google has fixed it.
  • Windows: a remote denial of service in the kernel's HTTP/3 code, CVE-2026-33096. Microsoft has fixed it.
  • Linux: a zero-click remote root flaw in the kernel's multipath TCP stack, CVE-2026-98432, patched upstream and backported to stable branches.

Anthropic says it followed its coordinated disclosure policy: 90 days for vendors to patch, plus 45 days before it discusses details beyond the public advisory.

Why AI exploit chains matter for your business

The gap between "patched" and "installed" is your risk. Attackers read advisories too. With models that can chain bugs, the time from a public fix to a working exploit gets shorter. A laptop that has not restarted Chrome in three weeks still runs the old code.

This week's list is short:

  1. Chrome on every machine: check chrome://settings/help shows version 156 or later, and restart it.
  2. Apple devices: install the current Safari or OS update.
  3. Android phones: install the latest security patch, Pixels first.
  4. Windows and Linux servers: apply the latest vendor and kernel updates, then reboot.

Then make it automatic. Use managed browser updates and a weekly reboot window. A patch you have to remember is a patch you will skip.

Key takeaways

  • Anthropic's unreleased model built exploit chains for Chrome, Safari, Android, Windows and Linux
  • Google patched 62 critical or high Chrome CVEs, 13 of them sandbox escapes, as of Chrome 156
  • Apple, Google, Microsoft and the Linux kernel have all shipped fixes
  • Your risk is unpatched devices: update and restart browsers, phones and servers this week
  • Automate updates so the next round does not depend on memory

Your patch status should be a dashboard, not a guess. We set up small-business fleets so browsers, devices and servers update on a schedule you can check. See our services.

Sources: Anthropic: Discovering vulnerabilities with Claude.

  • #anthropic
  • #ai-security
  • #chrome
  • #vulnerabilities
  • #patch-management
TR

Tommy Rush — Founder, Rush Commerce

Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More

Get The Rush Report weekly — one email, zero fluff.

Keep reading

AI & Automation2 min read

Gemini 4 Carbon: cyber defenders only, no public API date

Gemini 4 Carbon tops Google's cyber benchmarks but ships only to vetted defenders, with no public API date. Plan on Argon and shorten your patch cycle.

Read it
AI & Automation3 min read

OpenAI plans to buy Google TPUs: what it means for your AI bill

OpenAI plans to buy Google TPUs, per The Information and Bloomberg. No terms yet. Why AI chip supply shifts matter to your API costs and model routing.

Read it