Google says AI helped Chrome fix 1,072 security bugs across two recent releases

Google has outlined how the Chrome team is using AI systems across vulnerability discovery, triage, patch generation and update delivery, saying the approach has sharply increased the number of security fixes reaching users.

In a July 30 post, the Chrome Security Team said large language models are now part of an internal workflow that scans source code, helps reproduce reports, enriches bugs with metadata, proposes fixes and writes tests for developer review. Google framed the change as a response to the same pressure defenders face from attackers: AI can make vulnerability research cheaper and faster, so browser security teams need faster discovery and remediation pipelines of their own.

What changed

The strongest figure in the announcement is the recent fix volume. Google said Chrome milestones 149 and 150 fixed 1,072 security bugs, more than the total number fixed across the previous 23 milestones combined. The company also said its AI-assisted systems blocked more than 20 vulnerabilities from reaching production in May, including one critical S1+ issue.

The post describes several layers rather than a single model launch. Google said it has built an agent harness using Gemini, added a Chrome knowledge base that includes prior CVEs and git history, encouraged developers to write SECURITY.md files that explain trust boundaries, and added a critic agent to reason over those boundaries. The company also said the internal scans run on locked-down machines without general internet access, with network requests intercepted and restricted by allowlists.

Why it matters

Chrome is both a consumer browser and a major enterprise platform, so faster security work can affect billions of web sessions and a large downstream open-source ecosystem. Google said it is also piloting two security releases per week, researching dynamic patching that could update background processes without a full browser restart in most cases, and expanding memory-safety work such as MiraclePtr, spanification and targeted Rust adoption.

The announcement is also a signal about where software security is moving. Rather than treating AI bug finding as a side experiment, Google is tying it to the full vulnerability lifecycle: find more issues, route them faster, generate candidate fixes, test them across supported platforms and shorten the time between a fix landing and a user being protected.

Google cautioned that automation still needs guardrails and human review. But its Chrome update suggests browser vendors are beginning to reorganize security operations around continuous AI-assisted defense, not just occasional scans or manual triage queues.

Sources

• blog.google

Cover photo by Adam Sondel on Pexels, used under the Pexels License.