**Google Turns to AI to Fight Surge in Chrome Vulnerabilities**
This week, Google confirmed that the sharp increase in Chrome vulnerabilities discovered earlier this year is largely being driven by the use of artificial intelligence. According to the company, the rise in reported bugs began in April and continued through July, culminating in the latest browser release which contained 370 security fixes. In total, Google has patched over 1,800 bugs in 2024 alone.
A significant portion of this work was carried out by an AI-powered agent harness that leverages Google’s Gemini large language model. This system was designed to scan Chrome’s massive codebase for potential security flaws with greater speed and efficiency than traditional methods. In fact, Google recently patched 1,072 security defects with the release of Chrome 149 and 150, “surpassing the total number of security bugs fixed across the prior 23 milestones combined.”
One of the most significant victories for the AI system was the discovery of a long-standing sandbox escape vulnerability. The bug, tracked as CVE-2026-3545, had remained hidden in the browser for 13 years. If exploited, the flaw (CVSS score 9.8) could have allowed a compromised renderer process to trick the browser into reading local files. The vulnerability was patched in early May with the release of Chrome 145.
Google noted that the AI model was trained on a vast database of historical vulnerabilities, including prior Common Vulnerabilities and Exposures (CVE) entries and the entire Chrome Git history. The system even consumes developer-generated SECURITY.md files to better understand the codebase. To ensure stability and safety, the AI analyzes source code only while it is static and operates on isolated, locked-down machines that do not have general internet access.
While AI is handling the bulk of the heavy lifting, Google stresses that human oversight remains a critical component of the process. The company continues to rely on traditional security testing infrastructure and encourages researchers to submit vulnerability reports through its Vulnerability Reward Program (VRP). AI is also being used to help validate bugs, triage reports, and even generate candidate fixes, which has dramatically increased the speed of security patch deployment.
Looking to the future, Google is working to further reduce the time between vulnerability discovery and public disclosure by automating the generation of release notes and CVE descriptions. The company is also piloting a more frequent, twice-weekly security release schedule to complement its existing two-week major release cycle.
Ultimately, Google aims to eliminate entire classes of security issues, such as memory safety bugs, by transitioning the codebase to memory-safe languages like Rust and by hardening the runtime C++ environment. The long-term vision includes deploying more modular, AI-secure components and reducing reliance on traditional frameworks, ensuring that Chrome remains protected without interrupting the user experience.
—
### FAQ
**Q: Why did the number of Chrome vulnerabilities increase so dramatically this year?**
A: The surge is primarily attributed to the use of artificial intelligence. Google deployed an AI agent harnessing Gemini to scan the Chrome codebase, which allowed the company to find significantly more bugs than with traditional methods.
**Q: What was the most significant vulnerability discovered by the AI?**
A: The AI helped discover a sandbox escape vulnerability (CVE-2026-3545) that had existed for 13 years. The flaw could have allowed an attacker to read local files via a crafted HTML page.
**Q: How many security fixes were included in the recent Chrome updates?**
A: The latest releases (Chrome 149 and 150) contained 1,072 security fixes. In total, Google has patched over 1,800 bugs in Chrome so far in 2024.
**Q: Is AI replacing human security researchers at Google?**
A: No. Google emphasizes that AI is a tool to augment human effort. The company continues to rely on human researchers and traditional security testing infrastructure, welcoming vulnerability reports through its official Vulnerability Reward Program.
**Q: How is Google planning to speed up security updates?**
A: Google is piloting a twice-weekly security release cadence and automating the generation of release notes and CVE descriptions to reduce manual bottlenecks and speed up patch deployment.
—
### Conclusion
Google’s acknowledgment that AI is the primary driver behind the spike in Chrome vulnerability discoveries marks a significant shift in software security. By leveraging large language models to scan billions of lines of code, Google has not only identified a decades-old sandbox escape bug but has also drastically increased the rate at which it patches vulnerabilities. This proactive integration of AI into security workflows—combined with a commitment to memory-safe languages and more frequent updates—positions Chrome to be more resilient against emerging threats. While the challenge of securing complex software is ongoing, Google’s AI-powered strategy offers a robust blueprint for the future of browser security.
