Google AI Agents Find and Fix 1,072 Chrome Bugs in 60 Days
Updated
Updated · ZDNet · Aug 3
Google AI Agents Find and Fix 1,072 Chrome Bugs in 60 Days
3 articles · Updated · ZDNet · Aug 3
Summary
1,072 Chrome security bugs were found and fixed across milestones M149 and M150 in 60 days, exceeding the total patched over the prior 23 milestones combined.
Google said Gemini-based agents now handle vulnerability discovery, triage, candidate fixes, code review and test generation, saving hundreds of developer hours per month and weeks on some fixes.
One AI-discovered flaw was a sandbox escape dating to 2013 that had repeatedly passed human testing; Google said AI also helps reproduce bugs and route them to the right engineers.
Chrome, used by about 3.5 billion people and holding roughly 73% browser share, is pushing toward weekly or even twice-weekly security releases as AI speeds both defense and potential attacks.
Google is also testing dynamic patching and less disruptive restarts to shrink the gap between a fix being ready and users actually running a protected browser.
Google says Gemini helped fix 1,072 Chrome bugs in 60 days—but how many were truly dangerous, and can AI patch browsers safely at scale?
As attackers use AI to hunt flaws faster, can Google’s multi-agent Chrome defense really shrink the patch gap before users are exposed?
If AI found a Chrome flaw hidden since 2013, what else might autonomous bug hunters uncover in the software we use every day?
1,072 Chrome Bugs Fixed: Inside Google’s AI-Powered Security Revolution in June 2026
Overview
In June 2026, Google revolutionized browser security by integrating large language models (LLMs) into Chrome’s security workflows, enabling AI agents to patch 1,072 bugs in just two releases—more than the previous 23 milestones combined. This leap was powered by proactive AI-driven scanning in Chrome’s continuous integration system, which blocked vulnerabilities before reaching users. To ensure safety, Google established strict guardrails, requiring AI to operate on offline machines and only generate pull requests. Automated test-writing agents further accelerated patching, saving weeks of manual work. As AI-driven automation intensified, Google shifted to a rapid two-week release cycle and pioneered dynamic patching, delivering seamless updates without browser restarts. Despite these advances, human oversight remains essential for complex vulnerabilities, ensuring robust security as the industry embraces AI at scale.