Search — “CVE-2026-33096”

Anthropic's Frontier Red Team says an unreleased internal model found flaws and chained them into proof-of-concept exploits in lab conditions, with no real-world attacks seen and all reported flaws reported to vendors first. The Chrome chain combines four flaws (V8, sandbox escape, CacheStorage race, FedCM use-after-free) and was fixed in Chrome 156; the Safari chain was fixed in iOS/iPadOS 26.5.2; the Windows DoS and Linux multipath TCP root chain are tied to CVE-2026-33096 and CVE-2026-98432, though the public CVE records do not clearly match Anthropic's descriptions. Hunters have no in-the-wild behaviors to detect; the actionable item is verifying patch levels.