GoKawiilGoogle says artificial intelligence is dramatically increasing the number of security vulnerabilities it can find and fix in Chrome, with more than 1,000 security bugs patched across the browser's two most recent releases as it expands its use of AI.
According to Google, Chrome 149 and Chrome 150 fixed 1,072 security bugs, surpassing the total number fixed across the previous 23 Chrome milestones combined.
The company says it now uses large language models throughout the vulnerability management process, including discovering flaws, reproducing reports, determining severity, assigning bugs to developers, generating candidate patches, and creating tests.
Google began using LLMs to improve security fuzzing in 2023 before working with Project Zero on Naptime, a system that provided AI models with specialized vulnerability research tools.
The company later collaborated with Google DeepMind and Project Zero on Big Sleep, an AI-powered vulnerability discovery agent that found flaws in Chrome’s V8 JavaScript engine and graphics components.
In early 2026, Google created a Gemini-powered agent harness to search the broader Chrome codebase for vulnerabilities while reducing false positives.
Number of security bugs fixed in recent Chrome Stable release milestones
Source: Google
One vulnerability discovered by the system was a Chrome sandbox escape that had remained in the codebase for more than 13 years. If exploited, the flaw would have allowed a compromised renderer to escape the sandbox and trick the browser into reading local files.
Google is also encouraging its developers to add SECURITY.md files describing trust boundaries and threat models, helping its AI systems better identify operations with security implications.
... continue reading