Google Used AI to Find 1,072 Chrome Bugs. One Bug Hid in the Code for 13 Years.

Google fixed more Chrome security bugs in two updates than it had in the previous 23 combined. That is not a typo.

According to The Hacker News, Chrome versions 149 and 150, both released last month, closed out 1,072 security bugs between them. Chrome 151, which landed this week on Wednesday, patched another 370 flaws, 349 of which Google found itself. Seven of those were rated critical.

The jump did not happen because Chrome suddenly got sloppier. It happened because Google built an AI agent harness using its Gemini models in early 2026 and pointed it at the Chromium codebase, according to a post from the Chrome Security Team on Google's blog. The agents read through Chromium's Git history, old CVE entries, and component-level security notes, then propose fixes. Separate "critic" agents check those proposals against Chromium's coding conventions and security boundaries. Human engineers still review and approve every patch before it ships, so Google is calling these candidate patches, not autonomous repairs, per reporting from sqmagazine.

The 13-year bug

The single most notable find is a sandbox escape in Chrome's Navigation component, tracked as CVE-2026-3545 with a CVSS severity score of 9.6 out of 10. A compromised renderer process could have used the flaw to trick the browser into reading local files off a user's machine, according to The Hacker News. Google patched it back in March. It had been sitting in the code, undetected, for more than 13 years.

Google's own blog post calls this discovery a turning point: "For many of us, this moment cemented the potential of AI-powered vulnerability detection." That is Google's characterization of its own work, given the company has an obvious interest in showcasing the payoff of its AI investment.

This week's Chrome 151 update, covered by Malwarebytes, includes 15 security fixes, two of them critical. Both are buffer overflow vulnerabilities: CVE-2026-76034 in WebGL, the graphics API browsers use to render 2D and 3D content, and CVE-2026-76036 in Dawn, the library that implements the WebGPU standard. Either one could let a remote attacker execute code outside Chrome's sandbox using nothing more than a crafted webpage, according to Malwarebytes. The fix is live in Chrome 151.0.7922.169/.170 for Windows and Mac and 151.0.7922.169 for Linux. Users should update through Settings > About Chrome rather than assume the automatic rollout has already reached their machine.

Why the number is exploding industrywide, not just at Google

The surge isn't limited to Chrome. The Hacker News reports that the U.S. National Vulnerabilities Database has logged 46,872 flaws so far in 2026, already closing in on the 49,920 recorded for all of 2025. Mozilla saw a similar pattern: Anthropic's Claude Mythos model surfaced 271 vulnerabilities in Firefox, fixed in Firefox 150 on April 22, 2026, compared to just 22 bugs found in an earlier test run using an older Claude model, according to sqmagazine.

That cuts both ways. Veracode's 2025 analysis found that 45% of AI-generated code carries security vulnerabilities, meaning the same technology finding and fixing bugs is also introducing new ones elsewhere in the industry, per sqmagazine's reporting. AI is not a clean win. It is a faster arms race, and Google is racing to stay ahead of attackers who are using the same tools.

Danelle Au, writing in SecurityWeek's briefing roundup, put the stakes bluntly: "You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win." This is a real tension defenders now face, whatever side of the AI-hype debate you sit on.

What Google is changing operationally

Google is shifting Chrome's major-version cadence to two weeks and is piloting two security releases per week, citing "fast-moving, AI-powered attacks," according to The Hacker News. The company says every security bug that reaches Chrome Stable, whether found internally or reported externally, still gets documented and disclosed publicly, regardless of how the bug was found.

Google is also testing dynamic patching, so fixes can apply to background processes like the renderer or GPU without forcing a full browser restart, according to the company's own blog post. On macOS, Chrome 150 already takes advantage of the fact that the app often keeps running in the background even with no windows open, applying pending updates in that idle state.

Google also says its automated triage system now screens incoming reports for spam and duplicates, tries to reproduce each bug, and attaches stack traces and severity estimates before a human ever looks at the ticket. The company reported receiving more external bug submissions in March 2026 alone than in the whole of 2025, per sqmagazine.

The open question is scale versus scrutiny. Sqmagazine notes the 1,072 figure includes bugs caught during development, some of which never reached a stable build and some that were consolidated without individual CVE identifiers, meaning the raw number is a floor for total discovery activity, not a precise count of distinct shipped fixes. Whether Google's human reviewers can keep pace as the AI-driven discovery rate keeps climbing, without rubber-stamping candidate patches, is the question the next few Chrome milestones will answer.