This week, Google announced that the significant increase in Chrome vulnerabilities identified this year is largely due to the implementation of artificial intelligence (AI). The tech giant has been using AI tools to enhance the efficiency of detecting and patching security flaws in its popular web browser.
AI’s Role in Identifying Chrome Vulnerabilities
Since April, there has been a noticeable uptick in the number of bugs discovered in Chrome, culminating in July’s browser update that included 370 security patches. This brings the total number of vulnerabilities fixed to over 1,800 for the year. Notably, in the 149 and 150 versions of Chrome alone, Google addressed 1,072 security issues, surpassing the cumulative fixes of the prior 23 milestones.
Google attributes this success to its use of an agent harness powered by Gemini, which has significantly improved the detection of security flaws in Chrome’s codebase. A pivotal moment for this AI-driven approach was the identification of a critical sandbox escape vulnerability that had persisted unnoticed for 13 years.
Advanced Techniques and AI Integration
The critical flaw, identified as CVE-2026-3545 with a CVSS score of 9.8, was patched in Chrome version 145 in early May. This vulnerability could have allowed attackers to manipulate the browser to access local files via crafted HTML pages. Google’s security team began employing large language models (LLMs) in 2023, but it was the development of an agent harness in early 2026 that markedly increased their ability to detect and fix vulnerabilities.
This harness supports model interoperability and is trained using a comprehensive database of previously discovered vulnerabilities and Chrome’s extensive Git history. It utilizes SECURITY.md files contributed by developers and employs an AI ‘critic’ agent to repeatedly scan the codebase for potential security threats.
Future Outlook for Chrome Security
Looking ahead, Google is planning to reduce the patch gap by piloting a twice-weekly Chrome security release cycle, which will supplement the existing bi-weekly schedule for major updates. They are also working on automating release notes and CVE descriptions to streamline the process from vulnerability discovery to public disclosure.
To further enhance security, Google is focusing on eliminating entire classes of vulnerabilities, such as memory safety issues, by transitioning Chrome’s codebase to memory-safe languages like Rust. This transition involves expanding the use of MiraclePtr and MiracleObject, and integrating memory allocation protections to prevent common coding errors like use-after-free defects and integer overflows.
Google emphasizes the importance of maintaining a secure open-source software ecosystem and is automating vulnerability scanning and updates for third-party dependencies. By doing so, they aim to ensure that any discovered bugs are promptly fixed and updates are applied to users faster than potential exploits can occur.
