Anthropic describes a Safari chain using a JavaScriptCore TypedArray use-after-free, Gigacage escape and browser IPC to alter same-origin policy state in data memory. The demonstration requires a vulnerable Safari/WebKit build and an attacker page able to reach the reported browser primitives. The controlled exploit could access authenticated cross-origin…
Inspect the ClaimsCase · DiggingBeagle record
Claude-assisted Safari research changed cross-origin policy state without native code
Anthropic describes a Safari chain using a JavaScriptCore TypedArray use-after-free, Gigacage escape and browser IPC to alter same-origin policy state in data memory. The controlled exploit could access authenticated cross-origin response data through a browser policy mutation, without native shellcode execution.
Scope
The demonstration requires a vulnerable Safari/WebKit build and an attacker page able to reach the reported browser primitives. A data-only cross-origin read is not proof that real financial or personal accounts were stolen; Apple patched the reported chain.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- WITH AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. The vendor reports that the affected product was repaired; independent regression reproduction was not performed. Boundary: The policy outcome differs from the Chrome example: the important effect is cross-origin authenticated data access, not demonstrated native shellcode execution.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-ANTHROPIC-SAFARI-DATA-ONLY-1 · CLM-ENRICH-20261029-05 · Anthropic Frontier Red Team: five disclosed model-assisted exploit chains
At a glance
The controlled exploit could access authenticated cross-origin response data through a browser policy mutation, without native shellcode execution.
Read the implicationsA data-only cross-origin read is not proof that real financial or personal accounts were stolen; Apple patched the reported chain.
Limits and uncertaintyFull account
Anthropic describes a Safari chain using a JavaScriptCore TypedArray use-after-free, Gigacage escape and browser IPC to alter same-origin policy state in data memory.
The demonstration requires a vulnerable Safari/WebKit build and an attacker page able to reach the reported browser primitives. The controlled exploit could access authenticated cross-origin response data through a browser policy mutation, without native shellcode execution.
A data-only cross-origin read is not proof that real financial or personal accounts were stolen; Apple patched the reported chain. Apply the applicable Apple security updates and test origin enforcement at the privileged browser boundary.
Evidence interpretation and control boundary. The policy outcome differs from the Chrome example: the important effect is cross-origin authenticated data access, not demonstrated native shellcode execution. JavaScriptCore memory corruption, Gigacage traversal, browser IPC access and mutation of the origin-enforcement flag are individually meaningful boundaries. The bank and email examples illustrate possible exposure for logged-in users; the study does not claim observed theft from such accounts.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 27, 2026disclosure
Public disclosure
Claims & evidence
CLM-ENRICH-20261029-05Anthropic says its Safari chain changed same-origin enforcement and could read authenticated cross-origin responses without a native-code payload; those demonstrated browser capabilities are not a report of actual bank-account theft.supported
Basis: reported finding
- supportsAnthropic Frontier Red Team: five disclosed model-assisted exploit chainsprimary disclosure
Anthropic report: Chapter 2, Safari cross-origin data-only exploit and Apple remediation
CLM-CP23-ANTHROPIC-SAFARI-DATA-ONLY-1Anthropic describes a Safari chain using a JavaScriptCore TypedArray use-after-free, Gigacage escape and browser IPC to alter same-origin policy state in data memory. The demonstration requires a vulnerable Safari/WebKit build and an attacker page able to reach the reported browser primitives. The controlled exploit could access authenticated cross-origin response data through a browser policy mutation, without native shellcode execution.supported
Basis: reported finding
- supportsAnthropic Frontier Red Team: five disclosed model-assisted exploit chainsprimary disclosure
Anthropic report: Chapter 2, Safari cross-origin data-only exploit and Apple remediation
Implications
The controlled exploit could access authenticated cross-origin response data through a browser policy mutation, without native shellcode execution.
Controls and mitigations
- Apply the applicable Apple security updates and test origin enforcement at the privileged browser boundary.
Unknowns and contradictions
- A data-only cross-origin read is not proof that real financial or personal accounts were stolen; Apple patched the reported chain.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202