Anthropic Red Team: Claude found 5 exploit chains incl. one-click Chrome V8 RCE
emax · x · 2026-11-02
Anthropic's Frontier Red Team reports its unreleased internal research model discovered 5 critical attack chains in widely used software, enabling RCE with little to no user interaction.
- One-click Chrome RCE: Claude found a V8 heap corruption bug, then a second bug to escape V8's sandbox and defeat ASLR, building a ROP chain — the PoC pops Calculator on stock macOS Chrome seconds after page load.
- Targets are among the world's most security-critical software (browsers, OSes), affecting billions of users.
- All vulnerabilities disclosed via coordinated disclosure: 90-day patch window plus 45 days before further details.
- The sharer suggests reproducing CVE-2026-9843 to see how hard weaponization remains.
More from Models
- amasad warns subsidized AI subscriptions will get 'rug pulled' as Grok users hit limits faster — amasad · 2026-11-02
- vLLM serves DeepSeek-V4.1-Flash at 954K tokens/s per GPU on one GB300 NVL72 rack — bookwormengr · 2026-11-02
- OpenAI now caps paid ChatGPT accounts per device and payment card — Alone-Dragonfruit602 · 2026-11-02
- Tracker: Chinese open-weight models ~6-8 months behind frontier, gap widening past a year — scaling01 · 2026-11-02
- Google reportedly testing Gemini 4 Carbon checkpoint on Arena disguised as Argon 4 — testingcatalog · 2026-11-02
- 550M-param AlphaFold3 unbeatable on cost/quality, sparking small-vs-big model debate — nlarusstone · 2026-11-02