Google patched over 1,000 Chrome bugs in two releases using AI — more than the previous 23 milestones combined

What happened

Google says artificial intelligence is dramatically accelerating its ability to find and fix security vulnerabilities in Chrome. Across the browser's two most recent stable releases — Chrome 149 and Chrome 150 — Google patched 1,072 security bugs, a figure the company says surpasses the total number fixed across the previous 23 Chrome milestones combined.

The scale of this jump stems from Google's expanding use of large language models throughout the vulnerability management pipeline. According to the company, LLMs are now involved in discovering flaws, reproducing bug reports, determining severity, assigning bugs to developers, generating candidate patches, and creating tests.

Google's AI-driven security push has been building for several years. The company began using LLMs to improve security fuzzing in 2023. It then worked with Project Zero on Naptime, a system that gave AI models specialized vulnerability research tools. That effort evolved into Big Sleep, an AI-powered vulnerability discovery agent developed with Google DeepMind and Project Zero, which found flaws in Chrome's V8 JavaScript engine and graphics components. In early 2026, Google created a Gemini-powered agent harness to search the broader Chrome codebase for vulnerabilities while reducing false positives.

The news comes alongside a separate but related security development: CVE-2026-15903, a high-severity remote code execution flaw in Chrome's V8 JavaScript engine, was disclosed on July 23, 2026. The out-of-bounds read and write vulnerability affects Chrome versions prior to 150.0.7871.128 and allows a remote attacker to execute arbitrary code inside the browser sandbox through a crafted HTML page. While exploitation requires user interaction, such renderer-sandbox flaws are frequently chained with sandbox escapes for fuller compromise.

Why it matters

The 1,072-bug figure is a striking data point in an emerging trend: AI is not just helping companies write code faster — it is fundamentally changing how fast they can find and fix the mistakes in that code. As experts have warned for the last two years, companies like Microsoft and now Google are discovering and patching an exponential number of bugs thanks to LLMs and AI-assisted tooling.

For Chrome users, this means a more rapidly hardened browser. For the broader security community, it signals that AI-augmented vulnerability discovery is moving from experimental to operational. Google's pipeline — where AI agents discover, triage, patch, and test bugs — could become a template for other large software projects.

However, the same dynamics raise questions. If AI can find bugs at this scale for defenders, it can presumably do the same for attackers. The disclosure of CVE-2026-15903 is a reminder that serious vulnerabilities in widely deployed engines like V8 remain a live concern, even as AI-assisted patching accelerates.

What to watch

• Whether Google's AI-assisted bug-finding approach extends beyond Chrome to other major Google products such as Android or Google Cloud Platform.
• How the broader industry — Microsoft, Apple, Mozilla — responds in terms of disclosing AI-assisted vulnerability metrics of their own.
• Whether the increase in discovered bugs reflects a genuine improvement in security or partly an increase in lower-severity findings that AI surfaces more readily.
• The evolving threat landscape: as AI tools democratize vulnerability discovery, defenders and attackers may both scale, potentially reshaping the economics of exploitation.