Google's artificial intelligence systems identified and repaired 1,072 security vulnerabilities in Chrome over two monthly release cycles, the company's security team disclosed last week in a blog post. That two-month total exceeds the combined number of security flaws fixed across the previous 23 monthly releases, marking a dramatic acceleration in both vulnerability discovery and remediation. The findings reveal how AI is simultaneously exposing security weaknesses at unprecedented speed and enabling defense teams to keep pace with threats targeting the world's dominant browser, which serves roughly 3.5 billion active users.

The surge in detected vulnerabilities followed a sharp upward trajectory over recent months. Starting with Milestone 128 in August 2024, Google's team addressed approximately 50 bugs per monthly release, a pace that held steady through the first several milestones. Milestone 146 jumped to about 80 bugs, while M147 climbed to roughly 130. By M148, the count had soared to around 350 vulnerabilities. The pace then doubled again for M149 and M150, which together accounted for the 1,072 fixes that surpassed 23 prior releases combined. Among the discoveries was a sandbox escape vulnerability that had existed undetected in Chrome's codebase since 2013, repeatedly passing human-led test suites for more than a decade before Google's Gemini AI spotted it in early 2026.

The company attributes much of this acceleration to a multi-stage AI workflow that streamlines vulnerability discovery, triage, and patching. According to the blog post, Google collaborated with DeepMind and Project Zero on Big Sleep, an AI agent that successfully uncovered bugs in the V8 JavaScript engine and graphics stack. In 2026, the team rolled out an agentic framework built on Gemini designed to scan the entire Chrome codebase for vulnerabilities, running billions of scenarios to identify patterns of interaction that could trigger security failures. The report states that "this new process is saving hundreds of hours of developer time per month" by automating tasks like filtering duplicate reports, reproducing bugs across virtual environments, enriching case metadata, and routing issues to the appropriate human investigators.

The explosion in AI-discovered flaws creates both opportunity and risk. Because Chrome holds roughly 73% of global browser market share, a single exploited vulnerability immediately threatens more than half of the world's adult population. Google's AI agents now operate in a four-stage triage system that filters noise, reproduces bugs, compiles investigative reports, and assigns cases to developers. A separate multi-agent workflow then generates candidate fixes, critiques them, and constructs cross-platform tests before any human reviews the code. The company estimates this process saves weeks of developer time per fix. Yet the same AI capabilities available to Google are accessible to adversaries, raising the stakes in what the report characterizes as an arms race accelerating at warp speed. If Google can uncover two years' worth of bugs in two months, the pace of innovation has effectively compressed a decade of attack and defense cycles into a single year. To counter that velocity, Google is moving toward twice-weekly security releases and testing dynamic patching methods that could eliminate most browser restarts, aiming to close the window between fix deployment and user protection. The company faces a delicate balance: pushing critical updates without disrupting billions of users, while racing to patch flaws before attackers can exploit them.