LH048 reads: 10 November 2026 (discovery and baseline)

In short. We matched the flaws in Anthropic's five attack chains to the two vendor pages its post links, by a rule fixed beforehand, and then took the first reading of how each identifiable flaw is rated and whether it shows signs of exploitation. Four flaws can be followed: the named Windows and Linux ones, one Safari flaw that Apple credits to Anthropic, and one Chrome flaw that could be either of two steps. None is in CISA's catalogue of exploited flaws; all four are rated High or Critical by at least one source; their exploit-prediction scores are low. Mondays from 16 November say whether any of that moves. Unreviewed working notes.

Model disclosure: the exploits and the post are Anthropic's, and this checkpoint was written by a Claude Code session on Claude Opus 5.5, an Anthropic model.

Discovery read, 14:16 UTC (label 2026-11-10T1416Z)

Row LH048-discover. Three GETs (read log), all HTTP 200, each allowed by its site's robots.txt: the post, the Chrome 156 stable release note (dated Tuesday 20 October 2026; Last-Modified 10 November 08:29 GMT) and Apple's note on iOS 26.5.2 and iPadOS 26.5.2 (released 29 June 2026). The post's copy has two email addresses withheld.

The selection rule was applied by hand by the driving session at about 14:25 UTC, before any other source was read for these flaws, and committed in selection.json (commit 1ac3426) before the baseline:

The Chrome page says the update "includes 354 security fixes" and lists 353 CVE entries. Fifteen meet the credit test, all crediting Xinyang Ge (six of them "Xinyang Ge (Anthropic), assisted by Claude"); one is the V8 candidate and fourteen form the linked set, measured as context for the post's "62 CVEs" claim and never counted among the chains. The page credits no other contributor the post lists.

Baseline read, 14:18 to 14:20 UTC (label 2026-11-10T1418Z, --full)

Row LH048-baseline. 42 GETs (read log): 41 HTTP 200; the Chrome release page answered 503 (188 bytes) and is unavailable at this read (the discovery copy two minutes earlier is held). The per-CVE values below are from the summary, produced by python3 -I studies/LH048/scripts/summarise_read.py studies/LH048/data/read-2026-11-10T1418Z, a checkpoint aid that reads only retained bytes; the study's tabulator comes later. KEV catalogue 2026.11.09 (released 9 November 19:54 UTC, 1,773 entries).

(The Chrome severity word is the release page's from the discovery copy; Chrome's CNA records carry no score.) Both browser flaws' CVE records predate the post: the Safari flaw's was published 29 June 2026 and the Chrome flaw's 20 October; the Windows flaw's 14 April 2026.

The linked set (14 Chrome flaws): CISA's ADP rates 3 Critical (9.6), 10 High (8.8) and 1 Medium (6.5); NVD holds 13 as Modified and 1 as Analyzed; EPSS percentiles on 9 November run from 0.312 to 0.468, none above 0.5, and no step in any series; none is in KEV.

Measure 4 at the baseline (descriptive, interim): of the four followed flaws, only the ambiguous Chrome candidate meets all three parts of the gap (rated High or Critical, EPSS percentile at or below 0.5, not in KEV); the other three are rated High or Critical and not in KEV but sit above the 0.5 percentile. All 13 High or Critical members of the linked set meet all three parts. A percentile near 0.5 for a flaw rated 9.8 is a description of two signals side by side, not a claim about exploitation.

Notes

• The Linux flaw's NVD status read "Undergoing Analysis" here, where LH036's read of 9 November at 14:30 UTC read "Awaiting Analysis"; lastModified is the same (6 November 19:28:12), so NVD's own clock does not date the change. LH036's Thursday read will see it in its own data; the two studies' readings are not independent.
• NVD's record for the Windows flaw names its CNA source by an email address, withheld in the retained bytes and the summary.
• Nothing here is a rating change, a new CISA ADP container, an EPSS step since the post, a KEV listing or a changed page against an earlier LH048 read: this is the first. Not flagged for review: no public account cites these values.