How Google is using AI to find, triage, and patch Chrome vulnerabilities faster than ever

Over the years of writing about Chrome, ChromeOS, and the Google ecosystem, we’ve tracked browser security through every major era – from the introduction of silent background updates back in 2008 to modern sandboxing and memory safety initiatives. But the shift happening behind the scenes today is unlike anything we’ve seen before.

According to a detailed breakdown published on the Google Security Blog, Google is fully deploying AI models and multi-agent systems to find, validate, and patch security bugs in Chrome at a scale that human teams simply couldn’t match on their own.

For web-first users who practically live inside Chrome every day, seeing how Google is hardening the browser against modern threats isn’t just a technical exercise—it’s the backbone of keeping our web workflows safe.

Finding 13-year-old bugs with Gemini AI agents

Finding vulnerabilities before attackers do is an arms race. Historically, browser security relied heavily on fuzzing testing and reports submitted by external security researchers. However, early in 2026, Google deployed a specialized agent harness powered by Gemini across the broader Chrome codebase.

The results were immediate. The AI agent uncovered a sandbox escape vulnerability that would have allowed a compromised renderer to read local files – a bug that had quietly survived undetected in Chrome’s codebase for more than 13 years!

To scale this discovery capability safely, Google built a comprehensive knowledge base of Chrome’s entire Git history and CVE catalog, pairing vulnerability-finding LLMs with “critic” sub-agents to evaluate code boundaries while keeping the scanning agents locked down in secure, internet-isolated environments.

Fixing 1,000+ security bugs across two browser releases

Discovering bugs faster only helps if you can patch them just as quickly. To prevent backlog bottlenecks, Google built automated multi-agent pipelines to handle the entire lifecycle of a bug:

1. Automated Triage: Incoming bug reports are automatically filtered, reproduced on specific OS/browser builds, enriched with stack traces, and assigned a severity rating.
2. AI Fixing Loops: A fixing agent generates multiple potential code patches, while a critic agent reviews them in an iterative loop to ensure compliance with Google’s coding guidelines.
3. Automated Test Writing: AI sub-agents automatically write and execute test suites across supported OS platforms before a human developer even reviews the pull request.

The impact of this automated pipeline is staggering. Across recent Chrome Stable milestones (Chrome 149 and 150), Google fixed 1,072 security bugs, surpassing the total number of security bugs patched across the previous 23 browser milestones combined!

What’s next: Dynamic patching without restarting your browser

Even with weekly security updates, one of the biggest risks in browser security is the what is referred to as the “patch gap” – the window of time between when a fix is released and when a user actually restarts their browser to apply it.

To eliminate that friction, Google announced it is pioneering “dynamic patching” for Chrome. Leveraging Chrome’s multi-process architecture, dynamic patching will allow the browser to sequentially replace background child processes (like GPU and Renderer tasks) with updated binaries on the fly; eliminating the need to perform a full browser restart for most security updates.

In the meantime, Chrome 150 has already introduced a smart background auto-restart on macOS, applying pending updates whenever the browser is left running with all windows closed.

A safer foundation for the web

As power users who rely on Chrome for everything from daily editorial planning to testing web applications, watching Google pair AI agents with memory-safe coding initiatives (like expanding Rust adoption) gives us a lot of confidence in the future of the platform. By catching compound code risks in the submit queue and patching vulnerabilities in days rather than months, Google is ensuring that Chrome stays resilient in the AI era.