Chrome fixed 1,072 security bugs in two releases with AI

The bottleneck moved

Google’s Chrome Security team says Chrome 149 and 150 fixed 1,072 security bugs—more than the previous 23 stable milestones combined. The claim is bigger than an AI scanner finding a few clever flaws: Google is trying to turn the whole vulnerability conveyor belt into an assisted pipeline.

The models search the codebase, but Google says the surrounding system also reproduces reports, enriches them with severity and history, routes them to an owner, drafts candidate fixes, and writes tests. Developers still choose the patch; the intended gain is throughput without handing production changes to an unattended agent.

Finding bugs is only the first race

One early agent-found bug was a sandbox escape that had survived in Chrome for more than 13 years. Google says its internal scans run on locked-down machines without general internet access and with network requests intercepted by allowlists—an acknowledgement that a security tool with broad code access needs its own containment story.

The HN discussion’s useful correction is that a fix is not protection until it reaches a restarted browser. As one commenter put it, the hard part is not merely finding more flaws but closing the time window after a patch becomes visible. Google calls that interval the “patch gap.”

Release speed becomes part of security

Chrome normally takes weeks to move a landed fix into Stable. Google is moving toward two-week major milestones, weekly security updates, and a pilot of two security releases per week. It is also researching dynamic patching: replace background renderer or GPU processes without a full restart.

That makes the headline less about an AI benchmark than operations. More discovered bugs can make a browser safer only if triage, review, releases, and user updates accelerate with them. Google’s answer is to automate each handoff while reserving the final engineering judgment for people.