Multiple critical security vulnerabilities have been identified across Google Chrome, Apple Safari, Android, Microsoft Windows, and the Linux kernel. Anthropic’s internal research version of Claude identified and chained multiple security weaknesses into five working exploit chains, demonstrating potential impacts ranging from browser sandbox escape and cross-origin data theft to Android lock-screen bypass, remote denial of service, and zero-click remote code execution. Successful exploitation could allow attackers to access sensitive information, execute arbitrary code, compromise mobile devices, or disrupt critical servers. Anthropic reported the vulnerabilities to the respective vendors, and the affected vendors have addressed the reported issues.
CVE-2026-33096 (CVSS 7.5 – High): An out-of-bounds read vulnerability in the Windows kernel's HTTP/3-related networking implementation allows unauthenticated remote attackers to trigger system crashes by sending specially crafted network packets. Repeated exploitation can cause persistent denial of service against vulnerable Windows servers handling HTTP/3 traffic. Microsoft has addressed the vulnerability.[/subscribe_to_unlock_form]
Multiple critical security vulnerabilities have been identified across Google Chrome, Apple Safari, Android, Microsoft Windows, and the Linux kernel. Anthropic’s internal research version of Claude identified and chained multiple security weaknesses into five working exploit chains, demonstrating potential impacts ranging from browser sandbox escape and cross-origin data theft to Android lock-screen bypass, remote denial of service, and zero-click remote code execution. Successful exploitation could allow attackers to access sensitive information, execute arbitrary code, compromise mobile devices, or disrupt critical servers. Anthropic reported the vulnerabilities to the respective vendors, and the affected vendors have addressed the reported issues.
CVE-2026-33096 (CVSS 7.5 – High): An out-of-bounds read vulnerability in the Windows kernel's HTTP/3-related networking implementation allows unauthenticated remote attackers to trigger system crashes by sending specially crafted network packets. Repeated exploitation can cause persistent denial of service against vulnerable Windows servers handling HTTP/3 traffic. Microsoft has addressed the vulnerability.[emaillocker id="1283"]
CVE-2026-98432 (CVSS 9.8 – Critical): A use-after-free vulnerability in the Linux kernel's networking stack can be exploited through a race condition involving Multipath TCP (MPTCP). An unauthenticated remote attacker can exploit the flaw to disclose kernel memory, bypass Kernel Address Space Layout Randomization (KASLR), and manipulate kernel control flow to execute arbitrary commands with root privileges without user interaction. The vulnerability has been patched upstream and backported to maintained stable kernel branches.
The following reports contain further technical details:
[/emaillocker]