Chrome just had its buggiest month on record — and that’s actually good news.
In June 2026, Google shipped Chrome versions 149 and 150 carrying a combined 1,072 security fixes. To put that in perspective: that single month beat the total number of bugs fixed across the previous 23 Chrome releases combined, a stretch covering roughly two years of updates. Google isn’t blaming sloppier code. It’s crediting AI — specifically, a Gemini-powered system that’s now hunting for vulnerabilities across Chrome’s entire codebase, faster and more thoroughly than human researchers ever could alone.
From fuzzing to full-blown AI vulnerability hunters
This didn’t happen overnight. Chrome’s security team has been layering AI into its workflow since 2023, when it started using large language models to boost the coverage and performance of its security fuzzing. In 2024, it partnered with Google’s Project Zero on a project called Naptime, giving models specialized tools built for vulnerability research. By 2025, that had evolved into “Big Sleep,” an AI agent developed with DeepMind and Project Zero that found real bugs in the V8 JavaScript engine and Chrome’s graphics stack.
Early this year, that lineage matured into something more ambitious: an agent harness built around Gemini, designed to scan the broader Chrome codebase for flaws with fewer false positives and far more efficiency than earlier tools.
The bug that had been hiding for 13 years
The clearest proof of concept came in the form of a single vulnerability. The AI system surfaced a sandbox escape bug — tracked as CVE-2026-3545, with a severity score near the top of the scale — that had sat undetected in Chrome’s code for more than 13 years. If exploited, it could have let a compromised renderer trick the browser into reading local files off a user’s machine. It was quietly patched in Chrome 145 back in May.
For Google’s security team, that discovery was the moment the technology went from promising to proven.
Why more bugs found is a feature, not a red flag
It’s tempting to read “1,072 bugs in one month” as a sign Chrome’s code quality is slipping. Google’s framing is the opposite: these bugs always existed. AI is simply finding them faster than attackers can. Every flaw caught internally is one that never becomes a zero-day exploited in the wild.
That said, finding bugs faster creates a new problem: shipping fixes faster. Once a patch lands in Chrome’s public, open-source codebase, attackers can reverse-engineer it and race to exploit the flaw before most users have actually updated — the so-called “N-day” attack window. So Google is now re-engineering how updates get delivered, not just how bugs get found.
The response: faster updates, less friction
To close that gap, several changes are already underway:
- A faster release cadence. Chrome is moving to a two-week release cycle starting in September, with additional security updates slotted in between major versions. Google is even piloting the idea of twice-weekly updates.
- Dynamic patching. Google is developing a way to update key browser components without requiring a full restart — eliminating one of the biggest reasons users delay applying security fixes in the first place.
- Smarter restart timing. Rather than nagging users at random, Chrome is testing ways to detect when a person is less likely to be interrupted and prompting a restart then.
- Structural fixes, not just patches. Google is rewriting portions of Chrome in Rust specifically to eliminate entire categories of memory-safety bugs before they can even be introduced.
What this means for the external bug bounty world
Interestingly, human bug hunters are having a moment too. By March 2026, external researchers had already submitted more vulnerability reports to Chrome’s Vulnerability Reward Program than during the entirety of 2025. Google’s response wasn’t to shrug it off — it updated the VRP to specifically reward researchers for finding the kinds of bugs its internal AI tools are less likely to catch, effectively steering human expertise toward the gaps machines still miss.
Not every browser maker is seeing the same curve
Not all vendors are in the same place. Apple’s 2026 bug-fix count sits at roughly 482 — a pace closer to its historical norms, not the exponential jump Chrome is showing. Whether that reflects a different security philosophy, a different codebase, or simply a slower AI rollout isn’t clear yet. But it does suggest the AI-driven security surge isn’t industry-wide yet — it’s concentrated wherever companies have committed hardest to the tooling.
The bigger picture
Google’s own framing is blunt: AI has intensified the threat landscape for everyone, attackers included — but it’s also handing defenders a tool that, for the first time, can scan a decades-old codebase faster than any team of humans could. For roughly 3.5 billion Chrome users worldwide, that means vulnerabilities that might have quietly lingered for years are increasingly being caught in a matter of weeks.
The bug count going up isn’t Chrome getting worse. It’s Chrome finally seeing what was always there.
