Google is adjusting its Chrome browser update schedule to include security fixes twice a week. The company’s security team uses artificial intelligence tools for vulnerability discovery, triage, and patch development.
The 1,072 security bugs fixed in Chrome’s two releases in June exceeded the total number of flaws addressed in the previous 23 releases over two years, which stood at 1,036. This spike in identified vulnerabilities has driven the shift toward more frequent updates.
AI changes the economics of cybersecurity
Chrome’s director of engineering Doug Turner stated that large language models have fundamentally shifted the economics of cybersecurity. He described vulnerability discovery as an automated, industrial-scale operation.
Turner explained that the high volume of vulnerability fixes made it necessary to provide two updates per week during this period. He noted that applying models like Gemini allows the team to preemptively fix vulnerabilities and outpace adversaries.
A new equilibrium expected
Parisa Tabriz, Chrome vice president and general manager, described the current year as an inflection point for both offense and defense in cybersecurity. She acknowledged the near-term spike in bugs but predicted a new equilibrium will eventually emerge.
Google trains its AI model on every past Common Vulnerabilities and Exposures (CVE) entry and every line of code in Chromium's history. The company has been using machine learning for vulnerability discovery and fuzz testing since at least 2012.
In addition to AI-driven patching, the Chrome security team is rewriting parts of its C++ code in Rust to improve memory safety. The browser is currently piloting security fixes twice a week, moving toward a major release every two weeks with additional weekly security updates.
Chrome’s version numbers jumped from 126 in June 2024 to 149 and 150 in June 2025. Other major technology firms are also addressing significant numbers of security flaws, with Microsoft patching 570 vulnerabilities across its product lines in one month and Apple reportedly patching 482 bugs.
This article was generated with the assistance of artificial intelligence tools.
Updates
Google has significantly enhanced its security operations by integrating AI tools like Big Sleep, Naptime, and CodeMender into the Chrome CI pipeline, with these systems identifying a 13-year-old sandbox escape vulnerability. By May 2026, these automated tools successfully intercepted over 20 vulnerabilities, including a critical S1+ issue, before they reached production. Additionally, the Chrome Vulnerability Reward Program saw record-breaking submission volumes by March 2026, while new automated triage processes are now saving hundreds of hours of developer time each month.
Google's integration of AI tools like Big Sleep and CodeMender into its continuous integration system has significantly impacted security processes, with these tools running every 24 hours to identify vulnerabilities. In May 2026, these integrated AI tools blocked over 20 vulnerabilities from reaching production, including one critical S1+ issue. Additionally, an AI-discovered sandbox escape bug that allowed local file access was found to have existed in the Chrome codebase for over 13 years.
Google's AI tools, including BigSleep and CodeMender, are now integrated into the continuous integration system to run every 24 hours across all CLs. These tools helped block over 20 vulnerabilities in May 2026, including a critical S1+ issue, while a new automated triage process is estimated to save developers hundreds of hours per month. Additionally, an AI-discovered sandbox escape bug that had existed for over 13 years was recently identified within the Chrome codebase.
Google is developing 'dynamic patching' technology to allow Chrome to apply updates without requiring a browser restart, aiming for a long-term vision of a browser that remains constantly up-to-date. Additionally, starting with Chrome 150 on macOS, the browser will be able to automatically restart to apply pending updates if it is running in the background without any open windows.
Google is developing 'dynamic patching' technology to enable Chrome to apply security updates without requiring a browser restart. Additionally, starting with Chrome 150 on macOS, the browser will be able to automatically restart to apply pending updates when running in the background without open windows.
