Google Fixes 1,072 Chrome Bugs in Just Two Releases Using AI

Every update to your favorite browser brings along lots of goodness, which could include new features, enhanced protection, and security patches.

While software development has traditionally been a steady, iterative process, the AI era has scaled things up significantly. Google, already at the forefront of AI innovation with Gemini and its other offerings, has been quietly leveraging this technology to fix bugs in its Chrome browser that went unnoticed for months if not years.

Google recently published a detailed security blog explaining this process.

Rapid Pace

We previously discussed at length why defensive AI must outpace offensive AI. In this era of LLMs (Large Language Models), vulnerability detection and discovery are scaling at unprecedented levels—far beyond the limits of human speed.

To achieve greater resilience, Google decided to deploy AI models designed to find and fix these vulnerabilities at a highly rapid pace.

Google shared a helpful diagram illustrating the life cycle of a bug:

Source: Google Security Blog

The goal is to fix these bugs as soon as possible. The Chrome security team has been using LLMs since 2023 for automated vulnerability detection. In 2024, this team worked with Project Zero, giving LLMs specialized tools to improve and accelerate vulnerability research. In 2025, they collaborated with DeepMind and Project Zero on Big Sleep, an AI vulnerability discovery agent that successfully found bugs in the V8 JavaScript engine.

In early 2026, the Google Chrome Security team built an agent harness that leveraged Gemini to find vulnerabilities across the broader Chrome codebase with a lower FP (False Positive) rate. One of the bugs found had been lurking in Chrome’s codebase for over 13 years.

Imagine that: For 13 years, this bug existed without anyone catching it. Specifically, this was a “sandbox escape vulnerability”, one of the most dangerous types of bugs because it allows an attacker to break out of the browser’s secure isolation and reach the user’s underlying operating system. This perfectly highlights the immense potential of AI in defensive security

Google continued to build more capabilities to improve efficiency. This included model interoperability, building a knowledge base of previous CVEs and Chrome’s Git history, running vulnerability-finding models over the codebase multiple times to account for model non-determinism, and encouraging developers to add security.md files to provide models with better context.

The Result

A combination of the aforementioned efforts and more has yielded excellent results. The graph below shows how, in the last two milestones (Chrome 149 and 150), Google has been able to fix 1,072 security bugs. This is more than the cumulative fixes applied across the 23 milestones prior to these two. This is incredible.

Source: Google Security Blog