Google AI Workflow Pushes Chrome Security Fixes To 1,072 Bugs

Google's Chrome 149 and Chrome 150 fixed 1,072 security bugs, BleepingComputer reported, giving the browser team a larger test of AI-assisted vulnerability management than its earlier fuzzing work.

The contrast is in the workflow.

AI tools are finding more issues, but Chrome still has to move confirmed fixes to users before attackers can study public code changes and work backwards to the underlying vulnerability.

Chrome Fix Count Exceeded 23 Earlier Milestones

Google said the two-release total exceeded the combined security-fix count from the previous 23 Chrome milestones.

The company has also received more Chrome Vulnerability Reward Program submissions by March 2026 than it received during all of 2025.

The higher intake has changed how the browser team handles reports.

Automated triage now removes spam and duplicate submissions, reruns proof-of-concept exploit material, grades severity and sends confirmed issues to the right developers.

Google estimates that the process saves hundreds of developer hours each month.

AI Agents Move Across Chrome Security Workflow

Large language models are now part of discovery, reproduction, severity assessment, developer assignment, candidate patch creation and test generation.

Google began applying LLMs to security fuzzing in 2023, then worked with Project Zero on Naptime, which provided AI models with specialised vulnerability research tools.

The AI work later moved into Big Sleep, a vulnerability discovery agent developed with Google DeepMind and Project Zero.

That system covered the V8 JavaScript engine and graphics components before Google created a Gemini-powered agent harness in early 2026 for broader Chrome codebase searches with fewer false positives.

Google said the system identified a sandbox escape that had sat in Chrome for more than 13 years; exploitation would have allowed a compromised renderer process to break isolation and make the browser read local files.

The browser team is also adding SECURITY.md files that describe trust boundaries and threat models.

Those files give AI systems more context when deciding whether a code path has security implications, while fuzzing remains part of the existing testing stack rather than being replaced.

Patch Gap Moves To Faster Browser Updates

Patch delivery is becoming part of the same security cycle.

After a security fix is committed to the public Chrome repository, adversaries can review the diff and attempt to reconstruct the bug before users receive the update.

The browser roadmap now shortens both major and security-release timing.

Google is shifting Chrome to major versions every two weeks, continuing weekly security updates and testing a twice-weekly security-release rhythm.

The Chrome 150 macOS plan allows the browser to restart automatically in the background to apply a pending update when no windows are open.

Dynamic patching is the longer-term goal because it would let Chrome apply updates without restarting the browser.

User adoption of faster release and restart behaviour remains the condition that determines how much of the AI-assisted fix pipeline reaches installed browsers in time.