Google’s recent updates to its Chrome browser have addressed an unprecedented number of security vulnerabilities. In versions 149 and 150, the tech giant fixed a total of 1,072 security issues, surpassing the combined flaws addressed in the previous 23 updates. The trend continued with version 151, released on Wednesday, where 370 additional flaws were patched, including seven critical vulnerabilities.
Surge in Vulnerability Discovery
This surge in vulnerability discovery is attributed to the advanced capabilities of large language models (LLMs) that enhance the speed of bug reporting. As a result, vulnerabilities are being identified at a faster pace than ever before. Data from the U.S. National Vulnerabilities Database indicates that 2026 is on track to surpass 2025’s total recorded flaws.
A significant vulnerability, identified as a critical sandbox escape in the Navigation component (CVE-2026-3545), was particularly alarming. With a CVSS score of 9.6, this flaw could allow unauthorized access to local files on a user’s system. Discovered through Google’s Gemini models, it had remained undetected for over 13 years before being patched in March.
Enhancing Security Response
In response to these challenges, Google is adjusting its release strategy for Chrome. The company is moving toward a two-week release cadence for major updates, complemented by weekly security patches. This includes a pilot for twice-weekly security releases to address fast-evolving threats driven by AI-powered attacks.
Furthermore, Google emphasizes the importance of public disclosure. Every security bug reaching Chrome Stable is documented and disclosed, ensuring transparency. Efforts are also underway to automate the generation of release notes and CVE descriptions, reducing manual delays.
Future Outlook for Chrome Security
Looking ahead, Google is exploring dynamic patching techniques to apply updates without requiring browser restarts, thereby minimizing user disruption. This involves utilizing Chrome’s multi-process architecture to update components in the background seamlessly.
Google is also focusing on eliminating entire classes of security issues, such as memory safety flaws. By transitioning to memory-safe languages like Rust and updating Chrome’s user interface with HTML, CSS, and TypeScript, the company aims to reduce dependencies on traditional C++ frameworks.
Additionally, all third-party dependencies for Chrome will be moved to automated update pipelines, ensuring they remain current. This proactive approach underscores Google’s commitment to maintaining a secure browsing environment, continuously enhancing protection without compromising user experience.
