In June, Google announced it patched more security vulnerabilities in Chrome than it had in the previous two years, thanks to the implementation of artificial intelligence tools. The company successfully resolved 1,072 security flaws across the two latest versions of Chrome—Chrome 149 and 150—which were both released in June of this year. This marked a significant increase over the 1,036 security issues that were fixed in the 23 major releases of Chrome over the span of approximately two years prior.
The surge in newly discovered and fixed bugs wasn’t the result of a single tool, but instead a complex, multi-agent system developed by Google. The process began in 2023 when the company started incorporating large language models into its established security fuzzing techniques. These models were used to improve the effectiveness of testing code for vulnerabilities by generating random inputs to expose crashes and weaknesses.
AI-Driven Vulnerability Detection System
By early 2026, Google had introduced a new agent harness built on its Gemini AI technology, which was designed to scan the entire codebase of Chrome for potential vulnerabilities. This system is capable of handling both open-source and proprietary models, running multiple iterations to account for the unpredictability of AI, and drawing from a vast knowledge base. This includes the complete Git history of Chrome and records of every vulnerability previously discovered.
An additional ‘critic’ agent was deployed to analyze security documentation maintained by developers, helping to distinguish between simple crashes and actual security threats. Two earlier projects, BigSleep and CodeMender, were also integrated into the continuous development workflow and are now run daily to review all code changes submitted globally. In May 2026 alone, these systems successfully blocked over 20 vulnerabilities from being introduced into production code, including one that was classified as critical.
A Decades-Old Vulnerability Identified
Among the most remarkable findings was a vulnerability that had existed undetected in Chrome’s codebase for over 13 years. This flaw represented a sandbox escape, which could have allowed malicious actors to exploit the browser to access local files on a user’s machine. Traditional security practices typically focus on actively changing code or reports from external researchers. However, these methods aren’t designed to re-examine static code that may have been untouched for years.
The AI-driven process, in contrast, is built to trace the history of code changes over time. It draws upon the entire Git history to identify when certain functions or constructs were first introduced and assess whether the initial security assumptions still apply under the current architecture. This ability to look back at the full evolution of the code gave the system a unique advantage in uncovering the flaw.
Automated Fix Generation and Testing
After the vulnerability was confirmed, the system generated multiple possible fixes, evaluated them using the critic agent, and created cross-platform tests to ensure the solution worked across all operating systems. These automated tests run automatically before any human approval is needed. Google estimates this streamlined process saves hundreds of hours each month by reducing the need for manual review and triage.
With the rapid pace at which bugs are being discovered and fixed, Chrome has adapted its update process to handle the increased workload. Previously, the browser released weekly security updates. However, the team has now begun piloting a new update schedule that includes twice-weekly security patches. Doug Turner, Chrome’s director of engineering, explained in an interview that this shift makes sense given the high volume of recent fixes. While this new rhythm is currently in use, it remains to be seen whether it will be a permanent change.
Long-Term Security Improvements
In addition to updating more frequently, Google is also working on longer-term improvements to make Chrome more secure by design. One major change includes rewriting large portions of the browser’s codebase from C++ to Rust. This shift is intended to eliminate entire categories of common software flaws and make the browser more resistant to exploitation. Parisa Tabriz, Chrome’s vice president and general manager, described 2026 as a turning point for both offensive and defensive approaches to cybersecurity.
The trend is not limited to Google alone. Microsoft has also seen a significant rise in the number of bugs it addresses, reporting a record 570 security issues fixed in a single July 2026 patch update. The company explicitly credited AI for the surge in discoveries. Apple, however, has not shown the same dramatic increase. As of the end of 2026, Apple has patched 482 bugs, a figure that suggests it may be on track to match or slightly exceed the number of vulnerabilities it fixed in the previous year. This would be roughly the same as the total in 2015. While the company has not yet responded to inquiries about this discrepancy, the difference in performance is notable.