I’ve always assumed Chrome’s endless update notifications were just routine housekeeping with a batch of actually useful features every now and then. Turns out some of them are patching bugs that have been quietly sitting in the browser’s code for over a decade.
So how exactly is AI catching these bugs?
Google has built an AI agent powered by its in-house AI model, Gemini. Its entire purpose is to scan Chrome’s entire codebase for vulnerabilities, and it’s already proven itself.
Among the other fixes, one catch stood out. It was a sandbox escape bug that let a compromised part of the browser trick Chrome into reading local files. The most interesting and frightening fact is that the flaw had survived undetected for more than 13 years.
The system also handles triage now, sorting incoming bug reports through automated steps that filter spam, reproduce the issue, and attach severity ratings, work that used to take a human five to 30 minutes per report.
Once a bug is confirmed, a “fixing agent” generates candidate patches, followed by a “critic agent” that reviews them, and test-writing agents verify whether everything works across every platform Chrome supports before a human developer even looks at it. Google says this is saving hundreds of developer hours every month.
So does this actually mean more bugs are getting fixed?
Across just two recent Chrome updates, versions 149 and 150, Google fixed 1,072 security bugs combined, more than the previous 23 updates put together.
Google is also racing to close the “patch gap,” the window between a fix existing and it actually reaching your browser, by piloting two security releases per week instead of one. It’s also testing “dynamic patching” that could eventually eliminate needing to restart Chrome entirely for most updates.
Don’t get me wrong, though. None of this means Chrome suddenly has more bugs than before. It means Google’s finally catching the ones that were always there, faster than attackers can exploit them.
