Anthropic Demonstrates How Claude Bypassed Chrome's Security

Anthropic has presented a study showing that the experimental model Claude was able to bypass Chrome's security and execute code outside the isolated environment without user actions. Google released Chrome 156, addressing 52 vulnerabilities, including four critical ones. The update 156.0.8078.73/.74 for Windows and macOS and 156.0.8078.73 for Linux will be rolled out over the coming days and weeks.

Among the fixed issues are memory corruption, incorrect input validation, access control errors, and use-after-free vulnerabilities. Researcher Xinyang Ge, with the help of Claude, discovered critical CVE-2026-118306 and CVE-2026-118331; the OpenAI Codex Security tool helped find high-level issues in Turbolev, ImageCapture, Video, and PDFium.

According to Anthropic, Claude constructed a complete Chrome exploitation chain, allowing arbitrary code execution outside the sandbox. On macOS, opening a malicious page launched the "Calculator" in seconds: the model sequentially identified issues in the V8 engine, memory isolation, CacheStorage, and FedCM.

In total, Anthropic reported 62 Chrome vulnerabilities with CVE identifiers, fixed in Chrome 156. All of them are critical or high-level: 13 allowed escaping the isolated environment, 21 could compromise the page rendering process.

In Safari, Claude bypassed site isolation policies and accessed history and cookies; Apple released a fix. On Android, the model found a way to access data from a locked Google Pixel 9 via USB; Google addressed the issue. On Windows, CVE-2026-33096 was identified in QUIC with remote invocation of HTTP/3 server crashes, and on Linux, CVE-2026-98432 with command execution with root privileges via Multipath TCP without credentials. Anthropic also found vulnerabilities in FreeBSD, OpenBSD, and application isolation infrastructure.

The company emphasized that models are capable of combining individual errors into working attack chains with minimal human involvement. Anthropic recommended checking code at the change request stage and expanded the Cyber Verification Program.