AI model chains zero-day exploits in Chrome, Safari, and Linux kernels

Researchers used an unreleased internal AI model to identify and exploit critical security flaws in widely used software, including Chrome, Safari, Android, Windows, and Linux. The findings, published on October 27, 2026, demonstrate the model’s ability to construct complex, multi-step attack chains that result in remote code execution or data theft with little to no user interaction.

What happened

The research team deployed a specialized AI agent to audit some of the world’s most security-critical software. The model successfully generated five distinct exploit chains targeting browsers and operating systems. These were not isolated bugs but coordinated sequences of vulnerabilities that bypassed multiple layers of defense, such as memory sandboxes and address space layout randomization (ASLR). Each finding was reported to the respective vendor through coordinated vulnerability disclosure protocols, allowing time for patches before public details were released.

In Google Chrome, the model produced a one-click remote code execution exploit on macOS. It combined a heap corruption bug in the V8 JavaScript engine with a sandbox escape via a race condition in CacheStorage and a use-after-free error in the FedCM sign-in feature. This chain allowed arbitrary code execution outside the browser sandbox. Similarly, in Apple Safari, the AI constructed a data-only attack that bypassed the same-origin policy. By exploiting a use-after-free vulnerability in JavaScriptCore and leveraging weaknesses in the Gigacage memory isolation, the model gained read/write access to sensitive browser data like cookies and history without executing arbitrary code.

The scope extended beyond browsers to mobile and desktop operating systems. On Android, the model chained three vulnerabilities to bypass the lock screen on a Pixel 9, allowing data extraction via USB without user verification. In Windows, it identified a remote denial-of-service flaw in the HTTP/3 QUIC implementation by analyzing binary code. Finally, the team disclosed a zero-click remote code execution vulnerability in the Linux kernel’s networking stack, where a race condition allowed attackers to run commands as root.

How it works

The AI did not simply scan for known patterns; it engaged in deep reasoning and variant analysis. For proprietary software like Windows, the model used reverse-engineering tools to decompile binaries, reconstruct logic in C, and compare it against observed behavior to find discrepancies. For open-source components, it analyzed source code directly. The system employed a platform of parallel scanning agents, each using different strategies such as pure coverage checks, goal-based threat modeling, or specific exploit primitive searches.

A key mechanism was the model’s ability to chain disparate vulnerabilities. For instance, in the Linux kernel exploit, the AI first defeated KASLR by leaking kernel pointers through a race condition-induced overread. It then used the same underlying use-after-free bug to overflow a buffer and overwrite a callback pointer. This allowed the attacker to hijack control flow and execute a payload staged in kernel memory. The process relied on test-time compute scaling, where the model iteratively refined its approach until it produced a working proof of concept.

Key details

• Chrome 156 includes patches for 62 CVEs identified by the model, including 13 sandbox escapes and 21 renderer compromises.
• The Safari exploit bypassed the same-origin policy using a data-only attack, avoiding the need for arbitrary code execution.
• The Android lock screen bypass required physical USB access but skipped pairing verification and file transfer checks.
• The Windows vulnerability (CVE-2026-33096) allowed remote crashing of servers listening on HTTP/3 via an out-of-bounds read in the QUIC implementation.
• The Linux kernel flaw (CVE-2026-98432) enabled zero-click root access via multipath TCP, taking approximately 53 minutes to fully exploit in tests.
• All findings were reported under a 90-day patch window plus a 45-day disclosure delay.

Why it matters

This research signals a shift in the threat landscape where advanced cyber capabilities are no longer limited to elite specialist teams. AI models can now autonomously discover and combine vulnerabilities into working exploits, significantly lowering the barrier for sophisticated attacks. For software builders, this means that traditional security assumptions about the difficulty of finding deep, chained vulnerabilities may no longer hold. The speed and depth of AI-driven analysis require defenders to accelerate their own patching and testing cycles.

For engineering leads, the implication is that static analysis and manual code reviews are insufficient against AI-augmented adversaries. The ability of these models to perform variant analysis on confirmed findings means that a single discovered bug could quickly reveal a whole class of related vulnerabilities across a codebase. Defenders must adopt similar AI-driven testing strategies to keep pace, integrating automated scanning into their development pipelines to catch issues before they reach production.

What you can do

• Integrate AI-powered security scanning into your pull request workflow to catch vulnerabilities early in the development cycle.
• Implement automated variant analysis for any confirmed security issue to identify and patch related weaknesses across your codebase.
• Prioritize patching for critical infrastructure components, especially those exposed to untrusted input like network stacks and browser engines.
• Adopt a defense-in-depth strategy that assumes sandbox escapes are possible, limiting the impact of any single vulnerability.
• Participate in coordinated vulnerability disclosure programs to ensure responsible handling of discovered flaws.
• Monitor upstream patches for open-source dependencies, particularly in networking and memory management libraries, and apply updates promptly.