Chrome Uses AI to Fix 1,000+ Security Bugs Faster Than Attackers Can Exploit Them

Google’s Chrome Security Team has published a detailed account of how artificial intelligence is reshaping vulnerability management across the world’s most widely used browser, revealing that AI-assisted workflows helped fix more security bugs in just two release milestones than in the previous 23 combined.

The disclosure, published July 30, 2026, outlines a multi-year evolution from experimental AI fuzzing to a full-scale automated pipeline covering bug discovery, triage, patching, and release a shift the team frames as a direct response to attackers increasingly using LLMs to find exploitable flaws at scale.

Chrome’s AI security journey began in 2023 with LLM-enhanced fuzzing, expanded in 2024 with Project Zero’s Naptime framework, and matured into Big Sleep, a DeepMind collaboration that identified real vulnerabilities in the V8 JavaScript engine.

Chrome Uses AI to Fix 1,000+ Security Bugs Faster

By early 2026, Google had built a Gemini-powered agent harness capable of scanning the broader Chromium codebase. One standout discovery: a sandbox escape vulnerability that had lurked undetected in Chrome’s code for over 13 years, allowing a compromised renderer to read local files.

The team credits improvements like model interoperability, a custom knowledge base built from Chrome’s entire Git history, and SECURITY.md files that help models understand trust boundaries.

Historically, triaging a single vulnerability report consumed 5 to 30 minutes of analyst time. Chrome’s new automated pipeline compresses this into four phases: noise filtering, bug reproduction, metadata enrichment, and automatic routing, saving an estimated hundreds of developer-hours monthly.

Fixing vulnerabilities now relies on multi-agent workflows where a fixing agent proposes candidate patches, a critic agent evaluates them, and test-writing agents validate functionality across platforms. This loop mirrors human code review but operates continuously, contributing to the fixing of 1,072 security bugs across Chrome 149 and 150 alone.

Google is tackling the “N-day” problem the window between a public fix landing and users actually receiving it through two key initiatives: piloting twice-weekly security releases and developing “dynamic patching,” which would update background processes like the Renderer and GPU without requiring a full browser restart.

A near-term fix already shipped in Chrome 150: on macOS, Chrome now auto-restarts when all windows are closed, but the app remains running in the background, quietly applying pending updates during moments of zero disruption.

Beyond reactive patching, Chrome is pursuing a two-layered memory safety strategy. Hardening efforts include expanding MiraclePtr and the newer MiracleObject system to neutralize up to 90% of use-after-free bugs on the GPU main thread, alongside a “spanification” push that has already brought 97% of first-party Chrome code into compliance with strict buffer-safety checks.

Longer-term, Google is betting on Rust adoption through a centralized SDK designed to make Rust a “frictionless” choice for new components, particularly in high-risk areas like parsers and codecs.

With over 2,300 third-party dependencies, 1,700 of which ship directly to users, Chrome’s security posture extends well beyond its own codebase.

Google is now migrating these dependencies onto automated update pipelines that proactively pull the latest upstream versions, using safety signals from its GOSSIP intelligence platform to vet changes before they land.

The broader implication is clear: as AI accelerates both offensive and defensive capabilities in equal measure, the browser security arms race is entering a phase where automation, not just human expertise, determines who stays ahead.