Oct 29, 2026
Claude found 62 Chrome flaws, Anthropic says. All patched in Chrome 156
Claude found 62 Chrome security flaws, Anthropic says, all already patched as of Chrome 156. How one exploit chain opened a Mac's Calculator from a web page, and how to update Chrome.
Sir Toastimir
Illustration · Source: Anthropic
Claude found 62 Chrome security flaws, according to Anthropic's Frontier Red Team, which published its findings on Oct 27, 2026. The team used an unreleased, internal Claude research model. The good news first: Google has assigned 62 CVEs, and all of them are patched as of Chrome 156.
What was found
All 62 flaws were rated critical or high severity. Among them are 13 sandbox escapes and 21 bugs that could have been used to compromise Chrome's renderer.
One page, one click, Calculator
To show the risk, Claude chained four bugs into one exploit:
- a heap memory corruption bug in V8, Chrome's JavaScript engine
- a V8 sandbox escape and ASLR bypass
- a race condition in CacheStorage, used to read memory outside Chrome's process sandbox
- a use-after-free in FedCM, Chrome's federated sign-in feature, to run code outside the sandbox
Anthropic's proof of concept launches the Calculator app from a default Chrome browser on macOS within seconds of the page loading, without any further user interaction. Calculator is a harmless stand-in for "the attacker can run code on your computer".
How to update Chrome
- Open Chrome's three-dot menu (top right).
- Go to Help, then About Google Chrome. Chrome checks for updates and downloads them.
- Click Relaunch. You want version 156 or newer.
Anthropic also reports flaws in Safari, Android, Windows and Linux in the same research; see the full write-up below.
Links
Get your daily slice of AI
One short email with the best new AI tools, robots and AI & tech stock news. Free. Unsubscribe anytime.
We only use your email to send the newsletter.