Google's AI found a Chrome bug hiding for 13 years, and it's only getting faster

Published Aug 12, 2026, 2:00 PM EDT Richard is the PC Hardware Lead at XDA and has been covering the technology industry for almost two decades. He's been building PCs since young, and when not creating content, you can often find him inside a chassis somewhere. It's no secret that developers are using AI to speed up software development. Generating code, reviewing existing work, writing tests, and tracking down bugs are all tasks that tools such as ChatGPT, Claude, and Gemini can assist with. Google, however, is taking things considerably further with Chrome to help squash more bugs in the last two patches than the previous 23 milestones combined. A total of 1,072 security bugs were patched across Chrome 149 and Chrome 150, illustrating the scale Google believes AI can bring to browser security. But it's much more than that. Google isn't simply using AI to help write Chrome code. It's deploying specialized models to discover security vulnerabilities, triage bug reports, generate candidate patches, and help test fixes Finding the bug is only the beginning Getting more powerful by the day, as designed Large language models (LLMs) are fantastic tools for handling tasks at scale, particularly when it comes to coding. Whether you need something written up or checked, a well-equipped model can run through in a way that would be almost impossible to achieve with humans alone. So, the Chrome team decided to incorporate LLMs into the aforementioned stages of the process in protecting Chrome against potential attacks. But LLMs discovering vulnerabilities isn't going to solve things alone. That's where the other stages come in and make use of models. The Chrome team calls it "life of a bug," where an LLM discovers a vulnerability and triages a report. AI agents then generate candidate fixes and tests, with developers reviewing the resulting patch before it moves forward. Google finally releases an update to Chrome. The entire process happens at faster speeds compared to how things were traditionally handled. What's more is these new AI agents found bugs that existed for more than a decade. It's all driven by carefully set security reporting requirements, which help to eliminate duplicates and general reporting that doesn't satisfy the criteria. Once a report passes those initial checks, the automated system attempts to reproduce any proof-of-concept exploit against the affected operating system and Chrome versions, gathering additional information such as stack traces. It's important to note that this isn't Google simply firing up a chat window and asking it to discover a new vulnerability in Chrome and come up with a fix. These specialized agents are designed specifically for performing these different roles. For instance, a fixing agent will take contextual information on a vulnerability and generate several possible patches. Another agent will then evaluate these proposed fixes. It's akin to automating much of a traditional developer-code-review cycle, although a developer still reviews the resulting fix. LLMs are now producing candidate patches And Google wants to remove users from the equation too Google integrated tools developed with DeepMind and Project Zero to scan changes every 24 hours, which the company states in its findings prevented more than 20 vulnerabilities from reaching production releases in May alone. Another issue with this approach, even with LLMs and other agents handling the patching process, is that no matter how fast these are discovered, patched, and deployed, there will be Chrome installs that haven't yet applied the latest release. The goal is to create an always updated browser, which one could even view as Google treating Chrome like a live service. Once a security fix appears in Chromium's public source code, attackers can begin reverse-engineering the vulnerability before the update reaches every Chrome installation. Exploits targeting known vulnerabilities during this period are known as N-day attacks, while Google refers to the delay between disclosure and protection as the patch gap. So, while it's encouraging to see AI be used to handle so many bug reports and relieve strain on the system through the process, this can create a bottleneck at the release stage, almost requiring updates to be rolled out on a more frequent basis to avoid patches being held in Chromium's public source code repository. This is where things get even more interesting. Google is already transitioning Chrome toward a two-week major release cadence with weekly security patches, but we could see dynamic patching become reality, which would replace individual Chrome background processes with updated versions without requiring a full browser restart. Then there are experiments regarding opportunistic automatic browser restarts without disrupting a session. The goal is to create an always updated browser, which one could even view as Google treating Chrome like a live service. But even then, we're dancing around the more pressing matter that the same tools Google will use to help secure Chrome can also be used by malicious parties to tear it apart and find new vulnerabilities. This is why Google is combining AI throughout the vulnerability-management process with faster releases and new ways of applying updates: the aim is to get a patch onto users' systems before attackers can discover and exploit the same vulnerability. Finding more bugs creates another problem Google is betting that its own defensive measures can be adjusted and improved to accelerate vulnerability research, patch creation, and update deployment to stay one step ahead of attackers. AI, as a tool, allows just about anyone to create a website, app, image, or something else entirely. But it can also be used to come up with new vulnerabilities in software, which, like Chrome, may have gone unnoticed for some time. It's going to be on the developers to effectively use AI to protect their code and ensure it's as rock-solid as it can be with each patch, but also to encourage end users to always be using the latest version, which can go against some mantras where people may not trust code fresh off the press and instead may rely on caution when it comes to updating software.