Google Fixed More Chrome Bugs in One Month Than in the Past Two Years, Thanks to AI

The Numbers

Google says it fixed 1,072 security vulnerabilities across Chrome 149 and Chrome 150, both released in June. That figure exceeds the combined total of 1,036 bugs patched in the 23 Chrome releases that came before them, spanning roughly two years.

The jump was announced Thursday as part of a new white paper detailing how Google is deploying large language models across its entire vulnerability management pipeline.

How AI Finds the Bugs

Google does not attribute the increase to a single system. Instead, AI has been woven into nearly every stage of the security workflow, from initial discovery through patch deployment.

The effort traces back to 2023, when Google first began applying LLMs to security fuzzing. The company then built Naptime, a collaboration between its Project Zero team and internal AI researchers that equipped vulnerability research models with specialized tools. Later, Google DeepMind and Project Zero jointly developed Big Sleep, an autonomous agent that discovered flaws in Chrome’s V8 JavaScript engine and graphics subsystems.

One finding was particularly striking: a sandbox escape vulnerability that had existed in the Chrome codebase for more than 13 years. Had it been exploited, a compromised renderer could have tricked the browser into reading local files.

Today, Google uses AI models including Gemini to automate vulnerability triage. The systems filter spam and duplicates, reproduce proof-of-concept exploits, assign severity ratings, and route reports to the correct developers.

Once a vulnerability is confirmed, a second set of agents generates multiple candidate patches. A third agent evaluates those patches and compiles the information developers need to review them before committing to Chrome’s public source tree.

“By applying models like Gemini, we are preemptively fixing vulnerabilities, outpacing our adversaries, and making Chrome safer with every update,” Google stated in its white paper.

The Industry Context

Google is not alone in this shift. Earlier this month, Microsoft said it patched a record 570 security flaws across its product lines in a single Patch Tuesday, also crediting AI for the uptick.

Apple, meanwhile, has not shown the same exponential curve. An independent tally puts Apple at 482 bugs patched across its products in 2026, roughly on pace with recent years and similar to its 2015 totals.

What Changes for Users

Google is accelerating Chrome’s release schedule. The browser is moving to a two-week major release cycle with weekly security updates, and the company is piloting two security releases per week to close the window between a patch being written and it reaching end users.

The chrome Vulnerability Reward Program has also seen a surge in submissions. By March 2026, Google had already received more security reports than in the entirety of 2025.

For Chrome users, the practical takeaway is simple: keep the browser updated. Patches are arriving faster than at any point in Chrome’s history, and the gap between a vulnerability being discovered and it being exploited is shrinking on both sides.