- Google says AI helped identify and fix 1,072 Chrome security bugs across two browser releases.
- AI now automates vulnerability detection, triage, patch generation, and testing, saving hundreds of developer hours each month.
- Chrome is reducing the patch gap with faster updates and new dynamic patching technologies.
- Google is strengthening long term security through Rust adoption, memory safety improvements, and automated dependency updates.
Google is changing the way browser security works by putting artificial intelligence at the center of its vulnerability detection and repair process. The company says AI has helped its Chrome security team discover and fix 1,072 security bugs across just two browser releases, a figure that exceeds the total number of bugs fixed during the previous 23 Chrome milestones combined.
The announcement highlights a significant shift in how security flaws are identified, analyzed, and patched. Rather than relying primarily on manual investigation, Google now uses AI driven systems to search millions of lines of Chrome code, prioritize findings, generate potential fixes, and even verify patches before engineers review them.
The result is a much faster security pipeline that allows Chrome developers to focus on complex threats while AI handles much of the repetitive work.
AI Finds Hidden Bugs That Went Undetected for Years
According to Google, one of the biggest breakthroughs came earlier this year when its Chrome security team introduced an AI powered agent built on Gemini. The system was designed to scan the wider Chrome codebase with greater efficiency while reducing false positives that often slow down security research.
One of its most notable discoveries was a sandbox escape vulnerability that had remained hidden in Chrome for more than 13 years. The flaw could have allowed a compromised renderer process to trick the browser into accessing local files, making it a serious security concern despite remaining unnoticed for over a decade.
Google said this discovery demonstrated the practical value of AI in modern vulnerability research. Instead of simply speeding up existing workflows, the technology proved capable of uncovering long standing security weaknesses that traditional methods had failed to detect.
The company is also using AI to manage incoming vulnerability reports. Tasks that previously required between five and thirty minutes of manual work are now largely automated. AI can identify duplicate reports, reproduce reported bugs, determine severity levels, and route issues to the appropriate engineering teams.
Google estimates this automation saves hundreds of developer hours every month.
Smarter Fixes and Faster Protection for Chrome Users
Finding vulnerabilities is only one part of browser security. Google has also redesigned how fixes are created and tested before deployment.
Its automated repair system now generates multiple candidate patches for every detected issue. A separate AI model evaluates each proposed solution and selects the strongest one. Another specialized system writes and runs tests to ensure the chosen fix works correctly across Chrome’s supported platforms before engineers begin reviewing the changes.
This layered approach aims to improve both the quality and speed of security updates.
Google also revealed that its AI security tools are deeply integrated into its continuous integration infrastructure. These systems scan Chrome code every 24 hours and proactively identify potential vulnerabilities before they reach production.
The company said that during May alone, the automated system prevented more than 20 vulnerabilities from being included in production builds, including at least one critical security issue.
The success of these internal systems has also affected Google’s external vulnerability reward program. By March 2026, Chrome had already received more security reports than it had during the entire previous year. As a result, Google is adjusting its bug bounty program to encourage researchers to focus on findings that offer value beyond what its AI tools can already detect.
Closing the Patch Gap and Building Long Term Security
Google believes discovering vulnerabilities quickly is only useful if users receive fixes before attackers can exploit them.
One of the biggest challenges remains the period between publishing a security fix and users installing the updated browser. This window, commonly known as the patch gap, gives attackers time to study public code changes and develop exploits against systems that have not yet been updated.
To reduce this risk, Google is working on dynamic patching technology that updates Chrome’s background processes without requiring users to restart the browser. The company has also introduced a feature in Chrome 150 for macOS that automatically restarts the browser after all windows are closed if a security update is waiting to be applied.
Alongside faster updates, Google is investing in technologies that remove entire categories of vulnerabilities instead of fixing them individually.
Its MiraclePtr memory safety technology is expanding into more Chrome components, including graphics related libraries, with the goal of preventing most use after free vulnerabilities on the GPU main thread. At the same time, Google’s spanification project has enabled nearly all first party Chrome code to compile with strict unsafe buffer checks, reducing memory related risks before software is even released.
The company also reaffirmed its long term commitment to rewriting high risk browser components in Rust, a programming language designed to eliminate many common memory safety issues.
Security improvements extend beyond Chrome’s own code. Google is modernizing the update process for more than 2,300 third party dependencies used across Chromium and related projects. Continuous automated updates, combined with advanced security monitoring, are intended to reduce the risk of vulnerable external components reaching users.
Taken together, these efforts represent one of Google’s biggest security transformations in recent years. Rather than treating AI as a simple coding assistant, the company is using it throughout the entire security lifecycle, from discovering hidden vulnerabilities to validating fixes and speeding up updates. As cyber threats continue to evolve, Google believes combining automation with stronger engineering practices will help keep Chrome users better protected.
Follow TechBSB For More Updates
