Google: AI fixed more Chrome bugs than the previous two years combined

Google has revealed that the June releases of Chrome, versions 149 and 150, fixed 1,072 security vulnerabilities, more than the combined total from the previous 23 releases spanned across the last two years. The company attributes the jump to a growing set of AI-based tools that have been scanning Chrome's codebase for vulnerabilities since early 2026.

Until now, Google had only touted individual discoveries made by its AI-powered security tools, such as Big Sleep or CodeMender. This time, the company disclosed an aggregate figure for the first time, showing the scale of the effort across the full release cycle of one of the world's most popular browsers.

Where the surge in patches comes from

In early 2026, the Chrome team built dedicated agentic infrastructure based on Gemini models that scans the browser's entire codebase for vulnerabilities while keeping false positives low. Previously, similar work was handled mainly by Big Sleep, an agent developed jointly by Google DeepMind and the Project Zero team, which had already been finding bugs in the V8 engine and the graphics module.

The toolkit also gained CodeMender, a system that runs in continuous integration every 24 hours on every change to the repository. That means vulnerabilities are caught before they even reach the production branch, rather than only after a browser release ships to users.

A bug 13 years in the making

Among the discoveries Google is highlighting is a sandbox escape bug, tracked as crbug.com/487383169. It allowed a compromised renderer process to break out of the security sandbox and trick the browser into reading the user's local files. According to Google, the bug went unnoticed in Chrome's code for more than 13 years before the AI-based system caught it.

Bugs of this kind rank among the most dangerous, since they bypass one of the browser's core protective mechanisms, the isolation of page-rendering processes from the rest of the system. Their longevity shows that traditional code review and testing methods had limited success at catching this class of bug.

By using models like Gemini, we're proactively fixing vulnerabilities, staying ahead of our adversaries and making Chrome safer with every update - Doug Turner, Chrome engineering director

Large language models have fundamentally changed the economics of cybersecurity, turning vulnerability discovery into an automated, industrial-scale operation - Doug Turner, Chrome engineering director

A new update cadence

The scale of the discoveries is forcing Google to rethink its release schedule. The company is testing a move to two security patch releases per week, and ultimately wants to shorten Chrome's major release cycle from six weeks to two, while keeping weekly security updates. That marks a departure from the previous model, in which critical fixes typically reached users several weeks apart.

A similar trend is visible among competitors. Microsoft fixed 570 vulnerabilities in July 2026, and Apple fixed 482 in the same year, though in Apple's case the increase is not as pronounced as Google's. The security industry increasingly notes that AI tools are changing not just the pace of bug discovery, but also the pressure on vendors to patch just as quickly.

What it means for users

For Chrome users, this means more frequent browser updates, but also a lower risk that a critical vulnerability stays unpatched for weeks or years. A rising bug count doesn't necessarily mean Chrome has become less secure, it more likely means previously undetected vulnerabilities are finally coming to light.

For cybersecurity firms, it's further evidence that automated AI-driven vulnerability detection is becoming standard practice rather than an experiment. Google stresses, though, that finding a bug is only half the job, since every vulnerability still has to be verified and safely patched before it reaches billions of browser installations.