Tools AI-Found Vulnerability Register aifv-0078
Register entry
Claude-assisted research finds a Chrome WebRTC buffer overflow
- CVE
- CVE-2026-103631
- Project
- Google Chrome
- Component
- WebRTC
- Finder
- Xinyang Ge (Anthropic), assisted by Claude
- Model
- Claude (version unstated)
- Autonomy
- named human researcher assisted by Claude
- Evidence tier
- CNA credits the finder in its own advisory
- Assigner
- Chrome
- Severity
- High (Chrome vendor rating)
- Bounty
- Chrome VRP; reward TBD
- Confidence
- CONFIRMED
What happened
Chrome’s 1 October update fixes a WebRTC buffer overflow that can let a crafted HTML page execute code inside the browser sandbox. The release credits Xinyang Ge of Anthropic, assisted by Claude, with the report on 28 September.
Credit as recorded: Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-28. The fixed baseline is 154.0.8037.97. Windows and Mac received .97/.98; Linux received .97. The source names Claude without a model version, and lists the reward as to be determined. Date basis: vendor release note.
Sources
- Chrome stable release, 1 Octoberchromereleases.googleblog.com/2026/10/stable-channel-update-…
- Chrome CNA recordcveawg.mitre.org/api/cve/CVE-2026-103631
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 8 October 2026