Chrome patches 1,072 bugs in two releases as AI hunts vulnerabilities

Google's Chrome security team published a report Thursday revealing that the browser's two major version releases in June alone included fixes for 1,072 security bugs—a staggering number that exceeds the combined patch count from the prior 23 major releases. While many of these bugs come from external researcher submissions, the Chrome team attributes the surge primarily to its own rapidly evolving internal process for using AI tools in vulnerability discovery, triage, and patch development.

Parisa Tabriz, Chrome's vice president and general manager, acknowledged to WIRED that the team has long relied on machine learning to automate security work, citing vulnerability discovery and fuzz testing efforts dating back to at least 2012. "But I do think this year is very different," she said. "It really feels like an inflection point both for offense and defense." The intensity of the current moment has forced Chrome to move toward an accelerated release cadence: the browser is now piloting twice-weekly security patches, with plans to shift toward major releases every two weeks supplemented by additional weekly security updates.

Dug Turner, Chrome's director of engineering, explained the mechanics of the AI-driven discovery process. The team's machine learning models are trained on comprehensive historical context: every known CVE and every line of code in Chromium's entire history, along with the reason each line was changed. This encyclopedic training allows the models to identify vulnerabilities across Chrome's massive and complex codebase, including in features like printing that are no longer under active development and may attract fewer human eyes. "The way we ended up here is we had so many vulnerability fixes, so being able to provide two [updates per week] during this time, it made the most sense to us," Turner said. "Will that last forever? Who knows."

Turner and other security researchers believe the current vulnerability boom may be temporary. For mature, stable products like Chrome, evidence suggests a drop-off in newly discovered vulnerabilities once AI tools have exhausted the bulk of discoverable bugs. Beyond the patch frenzy, the Chrome security team is also pursuing long-term structural defenses, rewriting portions of C++ code in Rust—a "memory safe" programming language—to eliminate whole categories of common bugs. Tabriz cautioned that the industry must actively incorporate AI into its security development workflows, but warned against assuming automatic improvement: "There's this near-term spike, but I do think there's going to be a new equilibrium. My highest hope is that everything gets more secure. But I don't assume everything is going to just get better. I don't think it's going to come for free."