On October 27, Google released a Chrome security update that fixes 52 vulnerabilities. Eighteen are credited to Anthropic researcher Xinyang Ge or to Anthropic, more than one in three. The same day, Anthropic published a post from its Frontier Red Team, of which Xinyang Ge is among the seven contributors. An internal, non-commercial research model is presented as the author of complete attack chains against Chrome, Safari, Android and Linux, and of a denial of service flaw under Windows. Anthropic writes that “62 CVEs have been assigned and fixed” in Chrome through version 156, all of them critical or high severity.
ActuIA noted the eleven security bulletins for Chrome for computers published by Google between September 15 and October 29, 2026. Of the 929 flaws listed, 77 bear the name of Xinyang Ge or Anthropic. The first report dates from September 10, the last from October 23. None show a premium to date.
Seven Chrome security updates in October
Google published seven security updates for Chrome for computers in October, 1st, 6, 13, 15, 20, 27 and 29. They list 731 flaws, including 72 credited to Anthropic or its researcher, about one in ten. The share varies greatly from one bulletin to another. It remains low in both version updates: 14 flaws out of 247 for Chrome 155 on October 6, 15 out of 353 for Chrome 156 on October 20. In several intermediate fixes, it exceeds a third: 15 flaws out of 37 on October 13, 5 out of 10 on the 15th and 18 out of 52 on the 27th.
ActuIA report on the stable channel bulletins for computers, consulted on October 30, 2026. A flaw is counted once, in the bulletin which corrects it. ActuIA links to Anthropic the lines credited to the sole name of Xinyang Ge, contributor to the company’s post.
Only one name and no premium displayed
Except for two lines, all 77 cite the same researcher. Forty-nine are credited to “Xinyang Ge” without further mention, 26 to “Xinyang Ge (Anthropic), assisted by Claude” and two to “Anthropic and Ada Logics”, a security consulting company. Eighteen vulnerabilities are rated critical and 59 high, with no medium or low, which is consistent with Anthropic’s post. In the reward column, all have “N/A” or “TBD”, i.e. TBD. The 15 flaws credited to OpenAI Codex Security, OpenAI’s code auditing tool, are in the same situation.
When Chrome 156 was released on October 20, ActuIA’s count gave 55 credited flaws. On October 27, the day of the post, he gave 73. The 62 announced were between the two. Anthropic does not publish the list of its 62 CVEs, and Google only mentions Claude on 26 lines: line by line comparison is not possible. Google also warns in its bulletins, including that of October 27, that access to the details of the flaws may remain restricted “until a majority of users have received the fix”.
Windows, Linux and Apple: older patches
Outside of Chrome, the references given by Anthropic refer to fixes published before the post. The Windows flaw, CVE-2026-33096, was corrected during Patch Tuesday on April 14, 2026. It affects the HTTP.sys driver and allows remote denial of service without authentication, with a CVSS score of 7.5, according to the Tenable file. Anthropic estimates the number of exposed servers at “several millions”. The Linux kernel flaw, CVE-2026-98432, was released on October 15 with a score of 9.8, and fixed in all maintained stable branches, according to Anthropic.
The Apple bulletin cited by Anthropic covers iOS and iPadOS 26.5.2, released on June 29. He credits a WebKit flaw to “Milad Nasr and Nicholas Carlini with Claude, Anthropic,” two other contributors to the post, and also credits several to OpenAI Codex Security. For Android, Anthropic only writes that the issue was “addressed by Google”, without a CVE number.
Twelve days from report to fix
For the 77 Chrome flaws, ActuIA calculated the gap between the date of reporting and the publication of the bulletin: twelve days on median, from 3 to 41 days. In October, two security updates were never separated by more than seven days. A fleet that took two weeks to deploy a version of Chrome was therefore always at least one update late. The version to be required as of October 29 is 156.0.8078.79 on Linux, 156.0.8078.79 or 156.0.8078.80 on Windows and Mac.
Anthropic gives publishers 90 days to correct, then waits another 45 days before publishing details that go beyond the security advisory. His post recommends that developers analyze code at the time of each merge request, and says that analyzing your own code is “more important than ever.”
At Google, half of these flaws were fixed less than two weeks after they were reported. Each company still has time to deploy the patch.
Quotes translated from English by ActuIA.
Our articles will be prioritized in Google’s “Featured” section.
