LH048 sources

What the writer read to fix the brief, 9 November 2026 (UTC). No outcome for any LH048 flaw was read: no EPSS score, KEV entry, NVD record, CVE record, vendor page or Microsoft record for CVE-2026-33096, CVE-2026-98432 or any Chrome or Safari flaw. Every live URL was put to scripts/robots_gate.py with LIGHTHOUSE_PROVIDER=anthropic before it was fetched, at 14:22 to 14:23 UTC, and each was allowed.

• S1. Anthropic, "Discovering and exploiting vulnerabilities in critical, real-world software with Claude", https://www.anthropic.com/research/discovering-vulnerabilities-with-claude, datePublished 27 October 2026, dateModified 2026-10-30T15:24:16Z. Not fetched live: read from LH036's retained copies, studies/LH036/data/read-2026-11-05T1414Z/anthropic.raw.gz (fetched 2026-11-05T14:14:57Z, SHA-256 of bytes received 864937599ecce33a92206bd15295e0d1cff6000896d223225c45a8c19b329ba4) and, for comparison, studies/LH036/data/read-2026-11-01T0830Z/anthropic.raw.gz (2026-11-01T08:30:28Z, e18f2a98...2102). Read by the writer at about 14:20 to 14:22 UTC on 9 November. The two copies' visible text and links are identical apart from a related-articles block. Used for: the five chains, the steps each describes, the two CVEs named (CVE-2026-33096, CVE-2026-98432), the two vendor pages linked (S1a, S1b), the contributors' names and the "62 CVEs" claim.
  • S1a. Linked, not opened: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html (robots.txt allows; read at discovery).
  • S1b. Linked, not opened: https://support.apple.com/en-us/127594 (robots.txt allows; read at discovery).
  • Also linked and not opened: the NVD pages for the two named CVEs, https://www.anthropic.com/coordinated-vulnerability-disclosure (retained by LH038, not reread here), and others not bearing on the question.
• S2. Lighthouse's own records: studies/LH036/brief.md (protocol 0.1 of 1 November 2026, with its amendment of 8 November), studies/LH036/scripts/collect.py, studies/LH036/panel.json, and investigations/model-found-bugs.md, read 9 November about 14:15 UTC. The Linux flaw's state on 1 November in the brief comes from LH036's brief. LH036's checkpoints and its signal data were not opened.
• S3. EPSS API, feasibility on unrelated CVEs: https://api.first.org/data/v1/epss?cve=CVE-2024-4577,CVE-2024-38063&scope=time-series, 2026-11-09T14:23:38Z, HTTP 200: a batch request returns each CVE with a 30-day time-series, limit 100. Kept at data/pre-brief-2026-11-09T1423Z/epss_feasibility.raw.gz. FIRST's documentation page https://www.first.org/epss/api answered HTTP 404 at 14:23:20Z (kept); the API's behaviour was taken from S3 and from LH036's feasibility read of 1 November.
• S4. Microsoft Security Update Guide API, feasibility on an unrelated CVE: https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability?$filter=cveNumber eq 'CVE-2024-38063', 2026-11-09T14:23:21Z, HTTP 200 (robots.txt 404, no rules). Used for the field names only. Kept at data/pre-brief-2026-11-09T1423Z/msrc_CVE-2024-38063.raw.gz.
• S5. Documentation attempts that gave nothing usable: https://nvd.nist.gov/developers/vulnerabilities, 14:23:22Z, HTTP 200 but a script shell with no text; https://www.cisa.gov/known-exploited-vulnerabilities-catalog, 14:23:22Z, HTTP 403. Both kept. The KEV feed's fields and NVD API 2.0's fields named in the brief are those LH036 already reads; the CVE record's container structure is that of LH036's pre-brief read.

data/pre-brief-2026-11-09T1423Z/read_log.json gives each kept body's URL, time, status, length and SHA-256.