Google has announced a major milestone in browser security, revealing that its artificial intelligence systems helped identify and fix 1,072 security vulnerabilities across the last two Chrome releases. According to the company, this is more than the total number of security bugs fixed during the previous 23 Chrome milestones combined, highlighting how AI is dramatically accelerating vulnerability detection and software protection.
The Chrome Security team explained that it developed an AI-powered agent based on Gemini in early 2026 to scan Chrome’s massive codebase for hidden vulnerabilities. One of the most notable discoveries was a sandbox escape flaw that had remained undetected for more than 13 years. The vulnerability could have allowed attackers to access local files by exploiting Chrome’s renderer, demonstrating the ability of AI to uncover long-standing security issues that traditional methods failed to detect.
Google also revealed that AI is transforming the bug triage process. Previously, engineers spent anywhere from five to thirty minutes reviewing each security report. The new automated system now handles duplicate detection, bug reproduction, severity analysis, and routing to the appropriate development teams. This automation is saving hundreds of developer hours every month while allowing engineers to focus on fixing critical issues faster.
To further speed up security improvements, Google has introduced an AI-driven repair pipeline. The system generates multiple patch candidates, evaluates the best solution using a separate AI reviewer, and automatically creates test cases to verify the fixes before human engineers review the final code. Google says this approach has significantly reduced the time required to release secure updates.
The company also highlighted its collaboration with Google DeepMind and Project Zero, whose AI-powered tools continuously scan Chrome’s source code every 24 hours. In May alone, these systems reportedly prevented more than 20 vulnerabilities from reaching production, including at least one critical security flaw.
Beyond finding and fixing bugs, Google is working to reduce the “patch gap”—the time between a vulnerability being fixed and users installing the update. Chrome is introducing dynamic patching technologies and smarter update mechanisms, including automatic browser restarts on macOS after all windows are closed.
Looking ahead, Google plans to strengthen Chrome by expanding memory-safety technologies such as MiraclePtr, increasing compiler-based protections, rewriting high-risk components in Rust, and automating updates for more than 2,300 third-party software dependencies. The company believes combining AI-powered vulnerability detection with long-term architectural improvements will make Chrome significantly more secure as cyber threats continue to evolve.
