Google's AI patched more Chrome bugs in two releases than it had in two years, including a 13-year-old flaw

Q: What is Google's proposed two-security-release-per-week pilot intended to change about update delivery?

The pilot would increase security-update frequency to two targeted security releases per week so fixes reach users much faster than the current schedule. The goal is to reduce the time between finding a vulnerability and getting a patch to users, giving attackers less time to reverse-engineer flaws and develop exploits.

Q: What is dynamic patching for Chrome and what did the article say about its availability timeline?

Dynamic patching is a way for Chrome to apply security updates without requiring a restart by replacing background processes with updated binaries on the fly. The article says Google has not provided a timeline for when dynamic patching will arrive in stable builds and describes it as an active area of investment.

Q: How did the AI agents scan Chrome's codebase differently than traditional methods according to the white paper?

According to the white paper, Google built a multi-agent AI workflow that scans Chrome's codebase at a scale and speed not previously possible, enabling automated, large-scale analysis across the repository. This AI-driven scanning uncovered long-hidden vulnerabilities, including a 13-year-old sandbox escape, that traditional methods had missed.

Q: How does Google's increase in AI-driven detection compare to Microsoft’s recent Patch Tuesday effort mentioned in the article?

Google’s AI-driven detection produced 1,072 security fixes across two June Chrome releases, far exceeding Microsoft’s June Patch Tuesday total of 206 fixes. Both companies cited AI tools as a factor in their increased vulnerability discovery.

Google is piloting two Chrome security releases per week and developing updates that install without requiring a browser restart for faster patching.

VIEW GALLERY - 3

Hassam Nasir

Tech Reporter

Published Aug 1, 2026 11:25 PM CDT

1 minute & 30 seconds read time

TL;DR: Google's AI-driven multi-agent workflow rapidly scaled Chrome vulnerability discovery, enabling versions 149-150 to fix 1,072 security bugs-including a 13-year-old sandbox escape-and prompting a shift toward two security releases per week and efforts (zero window restart, dynamic patching) to deploy fixes without requiring browser restarts.

Voice: Hassam NasirSpeed

0:00 / 2:37

Google has published a white paper detailing how AI is transforming Chrome's security pipeline. Chrome versions 149 and 150, both released in June, collectively fixed 1,072 security bugs. That figure exceeds the total number of bugs patched across the previous 23 Chrome versions combined, dating back to June 2024.

Google has been building a multi-agent AI workflow for vulnerability research since 2023. Today, its AI-powered agents are scanning code at a scale and speed that were not previously possible. In one case, this AI-driven analysis uncovered a Chrome sandbox escape vulnerability that had remained hidden in the codebase for more than 13 years. If exploited, it could have allowed attackers to escape Chrome's sandbox and access local files.

Google's AI patched more Chrome bugs in two releases than it had in two years, including a 13-year-old flaw 1

VIEW GALLERY - 3 IMAGES

The pace of discovery is now fast enough that Google is rethinking its entire update delivery model. Chrome moved to a two-week major release cycle earlier this year, but the company is now piloting a shift to two security releases per week for targeted patches. In other words, Google wants to reduce the time between identifying a vulnerability and getting a fix into users' hands, giving attackers less time to reverse-engineer vulnerabilities and develop exploits.

Read more: Microsoft sets a Patch Tuesday record with 206 fixes, and finally patches every zero-day Nightmare Eclipse disclosed

The company is also working on several approaches to make Chrome updates faster and eliminate the need for a restart, a step many users delay and one that can leave their systems exposed longer than intended. Chrome 150 on macOS introduced what Google calls a "zero window restart," which takes advantage of the way macOS apps continue running in the background after all windows are closed.

Google's AI patched more Chrome bugs in two releases than it had in two years, including a 13-year-old flaw 2

Another solution is dynamic patching, which would allow Chrome to apply security updates without requiring a restart by replacing background processes with updated binaries on-the-fly. Google has not provided a timeline for when dynamic patching will arrive in stable builds, but describes it as an active area of investment.

Frequently Asked Questions

TweakBot answers common questions about this news using TweakTown's own coverage from this page and related content from our archive. Tap a question to reveal the answer, or type your own below.

Question #1

What is Google's proposed two-security-release-per-week pilot intended to change about update delivery?

Question #2

What is dynamic patching for Chrome and what did the article say about its availability timeline?

Question #3

How did the AI agents scan Chrome's codebase differently than traditional methods according to the white paper?

Question #4

How does Google's increase in AI-driven detection compare to Microsoft’s recent Patch Tuesday effort mentioned in the article?

Have a question not listed here? Ask below and TweakBot will answer it.

That said, the increase in AI-driven vulnerability detection is unlikely to slow down. Microsoft also cited AI tools when explaining its record-breaking 206-flaw Patch Tuesday back in June.