Google Now Patches Chrome Twice a Week as AI Finds Bugs Faster Than Humans Can Fix Them

Google's Chrome browser just had its busiest month of security patching in company history, and it's not because Chrome suddenly got worse. It's because AI got a lot better at finding the flaws that were already there.

According to a report published by the Chrome security team and covered by WIRED, Chrome's two major version releases in June included fixes for 1,072 security bugs. That single month beat the combined total of the prior 23 major releases. Not a typo. Twenty-three releases worth of fixes, topped in two.

Parisa Tabriz, Chrome's vice president and general manager, told WIRED this isn't a fluke. Google has used machine learning to hunt for vulnerabilities and automate fuzz testing since at least 2012, well before "AI" became a marketing buzzword. But Tabriz says 2026 feels different. "It really feels like an inflection point both for offense and defense," she said.

Why the Sudden Flood of Bugs

Chrome has been on a two-week major release cadence for a while now, with security patches layered on top. But the volume of new vulnerabilities being surfaced got so large that the team started piloting something more aggressive: shipping security fixes twice a week.

Doug Turner, Chrome's director of engineering, put it plainly to WIRED: "The way we ended up here is we had so many vulnerability fixes, so being able to provide two [updates per week] during this time, it made the most sense to us." He added that nobody knows if that pace is permanent. "Will that last forever? Who knows."

Part of what's driving the discovery boom is that Google is training its AI models on the entire known history of Chrome's vulnerabilities. Turner said the models are being built to know "about every security vulnerability that we have seen in the past" — every CVE, every historical bug — which lets the system flag patterns in current code that resemble prior flaws.

The Double-Edged Sword

This is genuinely good news for users in one sense: bugs that might have sat undiscovered for years, quietly exploitable by whoever found them first, are getting caught and patched by the people building the software instead of by criminals or foreign intelligence services. Chrome runs on billions of devices. A vulnerability sitting unpatched is a vulnerability someone else can weaponize.

But there's a fair concern: if defensive AI tools can find these bugs, offensive AI tools can find them too, and possibly faster, since attackers don't have Google's internal codebase and don't need to go through a public disclosure and patch process. Tabriz herself framed this as a two-sided coin, saying the moment cuts "both for offense and defense." The same technology accelerating Chrome's defenses is available to whoever wants to break in first.

There's also a legitimate practical question for ordinary users and IT departments: can real-world patch management actually keep pace with a twice-a-week cadence? Enterprises running Chrome across thousands of managed devices have testing and deployment cycles that weren't built around biweekly patch pushes, let alone twice-weekly ones. A decade ago, Google's move to automatic updates every six weeks was itself controversial, as WIRED notes, precisely because some in the industry weren't sure users needed or wanted that much churn. Now six weeks looks glacial.

Is This Sustainable

Turner and other researchers WIRED spoke with think the current bug-hunting frenzy has a shelf life, at least for a mature product like Chrome. The theory: AI tools are efficient at finding the low-hanging, pattern-matchable vulnerabilities first. Once that backlog gets cleared, discovery rates should taper off, since the remaining bugs will be the harder, more novel ones that pattern-matching against historical CVEs won't catch as easily.

Whether that prediction holds is unresolved. Chrome's security team has not published a timeline for when the twice-weekly cadence might scale back to something closer to normal, and Google has not said whether it plans to make the accelerated schedule permanent policy or keep treating it as a pilot. For now, Chrome users should expect their browser to nag them about restarting for updates more often than they're used to. That's the price of catching the bugs before someone else does.