**Google** recently announced a monumental effort in patching its **Chrome** browser, fixing a total of 1,072 security bugs in versions 149 and 150 alone. This figure surpasses the total number of flaws resolved in the preceding 23 milestones combined. Following this, the latest patch for Chrome 151, released last Wednesday, addressed an additional 370 vulnerabilities, with 349 reported internally by Google and seven flagged as critical in severity. ### The AI-Driven Vulnerability Explosion This dramatic increase in bug discovery is largely fueled by the advent of large language models (**LLMs**). These advanced AI tools are significantly accelerating the identification of vulnerabilities, leading to an unprecedented rate of new bug reports. The volume is so high that companies are struggling to fix issues as quickly as they are being found. According to statistics from the **U.S. National Vulnerabilities Database (NVD)**, 46,872 flaws have been recorded in 2026 so far, already nearing the 49,920 vulnerabilities reported for the entirety of 2025. ### Critical Sandbox Escape Discovered Among the significant flaws recently addressed is a critical sandbox escape vulnerability in Chrome's Navigation component. Identified as **CVE-2026-3545**, with a CVSS score of 9.6, this flaw could allow the browser to be tricked into reading local files from a user's system. Discovered via an agent harness leveraging Google's **Gemini** models, this vulnerability remained undetected in the codebase for over 13 years before being patched in March.  ### Accelerating Patching and Disclosure In response to this rapid pace of AI-powered attacks, Google is transitioning to a two-week release cadence for major Chrome milestones, complemented by weekly security updates. The company is also piloting a shift to two security releases per week. Google emphasized the importance of public disclosure, stating, "Every security bug that reaches Chrome Stable, regardless of whether it was discovered internally or reported externally, is documented and disclosed publicly as a standard best practice." To streamline this process, Google is automating the generation of release notes and **CVE** descriptions from security bug fixes, aiming to shorten the window between discovery and public disclosure. ### Enhancing User Experience and Security Beyond accelerated releases, Google is exploring ways to dynamically apply patches without requiring a browser restart, ensuring a seamless user experience. By leveraging Chrome's multi-process architecture, dynamic patching can sequentially replace background child processes (like the Renderer and GPU) with updated binaries on the fly. For instance, Chrome 150 introduced a feature for **macOS** users where, if an update is pending while all windows are closed, the browser automatically restarts in the background. Furthermore, Google is taking proactive steps to eliminate entire classes of security issues. This includes hardening the runtime environment to combat legacy C++ flaws, transitioning to memory-safe languages like **Rust**, and implementing the browser's top-level user interface using **HTML**, **CSS**, and **TypeScript** to reduce dependencies on traditional C++ frameworks. The company is also moving all Chrome third-party dependencies onto automated update pipelines to ensure they remain current. As the Chrome Security Team articulated, "Every bug found and fixed is one less foothold for an attacker. But discovering and fixing a bug is only half the battle - we must also ship the fix and apply the update for users faster than adversaries can exploit the bug... we are driving toward a browser that is continuously protected without disrupting the user."