Anthropic reports a controlled chain from V8 heap corruption through sandbox bypass, CacheStorage memory disclosure and FedCM use-after-free into native user-context execution on macOS. The demonstration required the vulnerable default Chrome build and a visited malicious page; user execution in the browser sandbox alone was insufficient. The final proof…
Inspect the ClaimsCase · DiggingBeagle record
Claude-assisted Chrome research combined four browser trust-boundary failures
Anthropic reports a controlled chain from V8 heap corruption through sandbox bypass, CacheStorage memory disclosure and FedCM use-after-free into native user-context execution on macOS. The final proof launched Calculator outside the browser sandbox without another click after page load.
Scope
The demonstration required the vulnerable default Chrome build and a visited malicious page; user execution in the browser sandbox alone was insufficient. Anthropic reports 62 total patched CVEs from its research program, not 62 such full exploit chains; no in-the-wild exploitation was established.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- WITH AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. The vendor reports that the affected product was repaired; independent regression reproduction was not performed. Boundary: This chain crosses three security layers whose failures are not interchangeable: V8 code running in a renderer, Chrome browser-process isolation, and a privileged browser component.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-ANTHROPIC-CHROME-MULTISTAGE-1 · CLM-ENRICH-20261029-02 · Anthropic Frontier Red Team: five disclosed model-assisted exploit chains
At a glance
The final proof launched Calculator outside the browser sandbox without another click after page load.
Read the implicationsAnthropic reports 62 total patched CVEs from its research program, not 62 such full exploit chains; no in-the-wild exploitation was established.
Limits and uncertaintyFull account
Anthropic reports a controlled chain from V8 heap corruption through sandbox bypass, CacheStorage memory disclosure and FedCM use-after-free into native user-context execution on macOS.
The demonstration required the vulnerable default Chrome build and a visited malicious page; user execution in the browser sandbox alone was insufficient. The final proof launched Calculator outside the browser sandbox without another click after page load.
Anthropic reports 62 total patched CVEs from its research program, not 62 such full exploit chains; no in-the-wild exploitation was established. Install the patched Chrome 156 release and keep both V8 and browser-process sandbox defenses enabled.
Evidence interpretation and control boundary. This chain crosses three security layers whose failures are not interchangeable: V8 code running in a renderer, Chrome browser-process isolation, and a privileged browser component. The observed Calculator launch establishes user-context native execution in the controlled macOS configuration; it does not establish persistence, root privileges or an active campaign. Its cumulative 62-CVE research-program figure must stay separate from the number of complete exploit chains.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 27, 2026disclosure
Public disclosure
Claims & evidence
CLM-ENRICH-20261029-02Anthropic describes one four-stage Chrome exploit chain ending in execution outside the browser sandbox, while reporting 62 patched CVEs across the wider research program rather than 62 complete chains.supported
Basis: reported finding
- supportsAnthropic Frontier Red Team: five disclosed model-assisted exploit chainsprimary disclosure
Anthropic report: Chapter 1, one-click remote code execution in Chrome; cumulative CVE count
CLM-CP23-ANTHROPIC-CHROME-MULTISTAGE-1Anthropic reports a controlled chain from V8 heap corruption through sandbox bypass, CacheStorage memory disclosure and FedCM use-after-free into native user-context execution on macOS. The demonstration required the vulnerable default Chrome build and a visited malicious page; user execution in the browser sandbox alone was insufficient. The final proof launched Calculator outside the browser sandbox without another click after page load.supported
Basis: reported finding
- supportsAnthropic Frontier Red Team: five disclosed model-assisted exploit chainsprimary disclosure
Anthropic report: Chapter 1, one-click remote code execution in Chrome; cumulative CVE count
Implications
The final proof launched Calculator outside the browser sandbox without another click after page load.
Controls and mitigations
- Install the patched Chrome 156 release and keep both V8 and browser-process sandbox defenses enabled.
Unknowns and contradictions
- Anthropic reports 62 total patched CVEs from its research program, not 62 such full exploit chains; no in-the-wild exploitation was established.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202