- Chrome fixed 1.072 security flaws in versions 149 and 150, more than in the previous 23 versions combined.
- A Gemini-based agent discovered a 13-year-old vulnerability that allowed local files to be read.
- Google is accelerating updates with patches twice a week and is working on dynamic patching without a reboot.
- AI is integrated throughout the entire cycle: detection, classification, patch generation, and validation.
The world's most popular browser has made a significant leap forward in its security. Google Chrome has patched 1.072 vulnerabilities in its two latest versions , a figure that surpasses the total number of patches applied in the previous two years. The company attributes this milestone to the massive integration of artificial intelligence into its vulnerability detection and repair processes.
According to data published by the Chrome security team, versions 149 and 150, released in June 2026, included more fixes than the previous 23 major versions combined. The use of large-scale language models (LLM) has allowed for the automation of tasks that previously required weeks of manual work , from identifying bugs to generating patch candidates.
An AI agent discovers a flaw hidden for 13 years
One of the most striking findings of this new approach has been the discovery of a critical vulnerability that had gone undetected for over a decade. The Gemini-based agent, created in early 2026, found a sandbox escape with a CVSS score of 9,8 . This flaw, registered as CVE-2026-3545, allowed a compromised rendering process to trick the browser into reading local files on the machine.
Google explains that the system was trained using the entire history of known vulnerabilities and the complete Chromium source code. The agent analyzes the code on isolated machines without internet access , reducing the risk of the AI itself being used maliciously. Additionally, developers can add SECURITY.md files to help the model identify the trust boundaries for each component.
End-to-end automation
Artificial intelligence not only finds flaws, but also participates in the entire vulnerability lifecycle. The system filters duplicate reports, reproduces the bug, determines its severity, and assigns the task to the appropriate developer . Google estimates that this process saves hundreds of work hours per month.
In the remediation phase, one agent generates several patch proposals, and another acts as a reviewer, comparing the solutions against the Chromium project's style guide. The models already generate candidate fixes for most vulnerabilities , and in May alone, they prevented more than 20 flaws from reaching production, including one critical vulnerability.
The company has also integrated these tools into its continuous integration system, which runs security scans every 24 hours at all build levels. This allows for the proactive detection of vulnerabilities before the code reaches users —a radical shift from the traditional model of waiting for an external researcher to report the issue.
Faster updates and dynamic patching
The flood of discovered vulnerabilities has forced Google to rethink its release cadence. Chrome already operates on a two-week major release cycle and weekly security updates , and is currently testing patches twice a week. Doug Turner, Chrome's director of engineering, explained that the decision is due to the large number of available fixes.
To reduce the window of exposure between patch release and installation, Google is working on dynamic patching. This technology would allow updates to be applied without needing to restart the browser , something already being tested on macOS with automatic restarts when the browser is running in the background with no windows open.
The future: fewer structural errors with Rust
Beyond fixing bugs one by one, Google is aiming to eliminate entire categories of vulnerabilities. The company is rewriting parts of Chrome's code in Rust, a programming language that is more secure than C++ in terms of memory management. Protections such as MiraclePtr and MiracleObject are also being deployed to neutralize post-release bugs.
Parisa Tabriz, vice president of Chrome, noted that AI has been a game-changer for both defense and attack. "My biggest hope is that everything will be more secure, but I don't take it for granted that it will automatically improve ," she told WIRED. The executive emphasized the importance of the entire industry adopting these tools to avoid falling behind.
The security team believes the current surge in discoveries could subside once AI has identified the most obvious vulnerabilities. However, in the meantime, the unprecedented pace of patching requires users to keep their browsers constantly updated to stay protected.
The combination of artificial intelligence, automation, and structural changes is redefining security in Chrome. With over 1.800 patches so far this year, the browser is becoming more robust against attackers , although the race to maintain its advantage never stops. Google is committed to a model in which AI not only finds vulnerabilities but also helps prevent them from the software design stage.
