Skip to content
Tech News
← Back to articles

AI is finding so many Chrome security flaws that Google may start updating it twice a week

read original more articles
Why This Matters

The rapid integration of AI tools in Chrome security analysis is accelerating the discovery and patching of vulnerabilities, prompting Google to consider more frequent updates, potentially twice weekly. This shift aims to enhance browser security and reduce exposure time to exploits, but also raises challenges around update adoption and potential misuse of AI by attackers. The move signifies a broader industry trend toward more agile, AI-driven security practices that directly impact both developers and consumers.

Key Takeaways

Forward-looking: Google is speeding up Chrome's update cycle as AI tools uncover a growing number of security flaws in the browser's code. Chrome versions 149 and 150, released within weeks of each other, carried a combined 1,072 bug fixes, more than the previous 23 versions delivered combined, reflecting how quickly AI-driven analysis is surfacing issues.

These tools are scanning code at a scale and speed that were not previously possible. In at least one case, the technology exposed a flaw that had remained in Chrome for 13 years. If exploited, the bug could have allowed attackers to bypass the browser's sandbox protections and access local files.

The rapid pace of discovery is forcing Google to rethink how it delivers updates. The company has already shortened its release cycle to every two weeks, but it is now testing an even faster model that could push updates out twice a week. The goal is to reduce the time between identifying a vulnerability and getting a fix into users' hands.

The same AI capabilities helping Google find bugs could also be used by attackers to locate weaknesses just as quickly. Faster patching is one way to limit that risk.

But releasing updates more often creates another problem: users do not always install them right away. Chrome typically downloads updates in the background, but it still depends on a browser restart to complete installation. Many users delay that step, leaving systems exposed longer than intended.

Google is starting to address that issue. In Chrome 150 on macOS, the browser can now update itself when all windows are closed, but the app is still running in the background. The company calls this a "zero window restart." When the user opens Chrome again, the update has already been applied, avoiding the need for a manual restart in many cases.

Google is also working on a more advanced approach known as "dynamic patching." This would allow updates to be applied without any restart at all. Google has not provided details on when that capability might be ready, but it says it is continuing to invest in the effort.

The increase in AI-driven vulnerability detection is unlikely to slow down. As those tools become more capable, the pressure to respond quickly will only grow, which may be why Google is moving to a different model for browser security. Rather than relying on periodic updates that require user action, Chrome is moving toward a system in which fixes are delivered continuously and with little or no disruption.