Google’s AI patched more Chrome bugs in two releases than the previous two years combined

Google has published a white paper with a number that should recalibrate how you think about AI and security: Chrome versions 149 and 150, both released in June, collectively fixed 1,072 security bugs. That is more than the previous 23 Chrome releases combined, a stretch reaching back to June 2024. The browser’s defenders just got very fast, and the reason is machines hunting bugs at machine scale.

What the AI pipeline actually does

Since 2023, Google has been assembling a multi-agent AI workflow for vulnerability research: systems that read code, reason about how components interact, generate candidate exploits and triage what they find, at a scale no human team could staff. The results in Chrome 149 and 150 are the pipeline hitting production maturity. This is not AI writing code faster; it is AI auditing code deeper, continuously, across one of the most scrutinized codebases on Earth.

The trophy finding is the 13-year-old sandbox escape. Chrome’s sandbox is the wall between a compromised web page and your files, and a hole in it had survived over a decade of human review, fuzzing and external bug bounties. The AI found it by reasoning about the code in ways the existing tooling could not. Had attackers found it first, the consequences would have been severe: escape the sandbox, reach local files, own the machine behind the browser.

Why this changes the security math

Defensive security has always been economically lopsided: attackers need one hole, defenders need all of them. AI-assisted vulnerability research is the first development in years that shifts that balance toward defense, because it makes comprehensive auditing cheap enough to run continuously instead of occasionally. The same capability exists for offense, which is exactly why the discovery-to-patch window now matters more than ever.

The two-releases-per-week pilot

That logic is driving a structural change to how Chrome ships. The browser moved to two-week major releases earlier this year, and Google is now piloting two targeted security releases per week on top. The reasoning is simple: every day between finding a vulnerability and patching it is a day attackers can reverse-engineer the fix or find the same flaw independently. Compress the window, and you compress the opportunity. The browser as we know it is quietly becoming a continuously patched service.

The offensive side of the same coin

It would be negligent to celebrate the defensive gains without naming the obvious mirror: the same techniques that find bugs to fix can find bugs to exploit. Frontier models already demonstrate real vulnerability-discovery ability, and every advance in defensive AI auditing is also an advance in offensive capability, differing mainly in who runs it and why. Google’s answer, implicit in the white paper, is that the defender with the codebase and the tooling has the structural advantage, provided they move first and patch fast. That is a reasonable bet. It is also a bet that has to keep winning continuously.

Why the 13-year-old bug matters most

Of everything in the report, the sandbox escape that hid for thirteen years deserves the most attention, because it answers the oldest objection to automated security research: that anything findable would have been found. Chrome is among the most attacked and most audited codebases in existence, with a mature bug bounty and world-class fuzzing. A critical flaw still survived in it for over a decade. If AI can surface that, the implication for less scrutinized code, the enterprise software and infrastructure the world actually runs on, is enormous, in both directions.

What it means for users and the industry

For users, the takeaway is uncharacteristically simple: keep auto-update on, and restart your browser when it asks. The cadence is about to increase, and each of those small updates now carries real weight. For the rest of the software industry, Chrome just demonstrated the template: build an AI auditing pipeline, feed it your codebase, and prepare your release machinery for what it finds. Every major vendor will now be measured against a thousand bugs per month.

The governance side of this shift, who verifies AI-found fixes and how AI output gets labeled, connects to the broader accountability push we covered in our report on Anthropic’s text watermarking. AI is simultaneously becoming the best bug hunter and the thing that needs oversight. Both can be true.

The ripple effects across the browser market will be worth watching. Chrome’s engine powers Edge, Brave, Opera and most of the browsing world, so these fixes propagate far beyond Google’s own user base. For Firefox and Safari, the announcement sets an uncomfortable benchmark: matching a thousand patched bugs per month requires the same kind of AI auditing investment, and smaller security teams will feel the pressure. Security velocity is becoming a competitive feature, marketed like tab groups and reading modes once were.

None of this removes humans from the loop, and Google is careful to say so. AI agents surface candidates; human engineers verify, write the fixes and decide what ships. The leverage is in the ratio: one reviewer can now validate what an army of automated analysis produces, which is why the output numbers look so alien next to historical baselines. The job of the security engineer is not disappearing. It is being re-scoped from hunting individual bugs to supervising the machine that hunts them at scale.

The white paper and release details are published on the Chromium project site.

The bottom line

Would you trust AI-audited code more, or less? Tell the tech desk.