**Google** has reported a significant surge in security vulnerability fixes for **Chrome**, attributing this success to the expanded use of artificial intelligence. The two most recent **Chrome** releases, versions 149 and 150, collectively addressed 1,072 security bugs – a number that surpasses the total fixed across the previous 23 **Chrome** milestones combined. ### AI's Role Across the Vulnerability Lifecycle **Google** is now integrating large language models (LLMs) throughout its entire vulnerability management process. This includes initial flaw discovery, reproducing vulnerability reports, determining severity levels, assigning bugs to developers, generating candidate patches, and creating robust tests. Initiated in 2023, **Google**'s journey with AI in security began by improving security fuzzing. This evolved into collaborations with **Project Zero** on systems like **Naptime**, which equipped AI models with specialized vulnerability research tools. Further advancements came with **Google DeepMind** and **Project Zero**'s **Big Sleep**, an AI-powered vulnerability discovery agent that successfully identified flaws within **Chrome**'s **V8** JavaScript engine and graphics components. By early 2026, **Google** had developed a **Gemini**-powered agent harness specifically designed to search the broader **Chrome** codebase for vulnerabilities while significantly reducing false positives.  One notable discovery by this AI system was a **Chrome** sandbox escape vulnerability that had persisted in the codebase for over 13 years. Had it been exploited, this flaw could have allowed a compromised renderer to bypass the sandbox and trick the browser into accessing local files. ### Empowering Developers and Streamlining Processes **Google** is also encouraging its developers to implement **SECURITY.md** files within projects. These files outline trust boundaries and threat models, aiding AI systems in better identifying operations with security implications. It's important to note that **Google** views these multi-agent AI workflows as complementary to, rather than replacements for, existing security testing methods like fuzzing, which remains highly effective in uncovering complex vulnerabilities. The company has also observed a sharp increase in submissions to the **Chrome Vulnerability Reward Program**. By March 2026, more security bug reports were received than during the entirety of 2025. This surge prompted **Google** to refine its program, prioritizing reports that offer novel insights beyond what its automated tooling already identifies and processes. To manage the influx, **Google** is automating vulnerability triage, which includes filtering spam and duplicate reports, reproducing proof-of-concept exploits, assigning severity ratings, and routing reports to the appropriate developers. This automated process is estimated to save hundreds of hours of developer time each month. Once a vulnerability is confirmed, specialized fixing agents generate multiple potential patches. Another agent then evaluates these proposed fixes and provides additional information for developers to review. In May, these systems reportedly prevented over 20 vulnerabilities, including one classified as critical, from reaching production. ### Accelerating Patch Delivery Finding and fixing vulnerabilities more quickly necessitates an equally rapid delivery of patches to users. Attackers can reverse-engineer vulnerabilities by inspecting security fixes committed to **Chrome**'s public source code before updates reach end-users, creating a critical window of exposure. To mitigate this, **Google** is transitioning **Chrome** to a two-week major release cycle with weekly security updates and is piloting two security releases per week. Furthermore, the company is developing "dynamic patching," a feature that would allow **Chrome** to apply updates without requiring a browser restart. Starting with **Chrome** 150 on **macOS**, the browser can automatically restart to apply pending updates when running in the background without any open windows. **Google**'s long-term vision is to maintain continuous **Chrome** updates through a combination of dynamic patching, automatic restarts during periods of inactivity, and improved session restoration.