Google is rebuilding Chrome security using AI to catch hidden vulnerabilities

Jul 30, 2026 — 1:00 PM ET

Google is leveraging Gemini-powered AI models to overhaul Chrome’s security, discovering and fixing 1,072 vulnerabilities across the last two milestones, more than the previous 23 milestones combined.
To handle the massive increase in bug reports, Google has implemented multi-agent workflows in which AI agents automatically triage issues, draft candidate code fixes, serve as critics, and write cross-platform tests.
To prevent attackers from exploiting known vulnerabilities before users update, Google is piloting two security releases a week and pioneering “dynamic patching” to apply critical background updates on the fly without requiring a full browser restart.

Google is fundamentally overhauling how it secures Chrome, leveraging AI to discover, triage, and patch vulnerabilities at a speed traditional security workflows simply can’t match. As the browser picks up user-facing tweaks like an Appearance menu and under-the-hood scroll performance upgrades, Google’s underlying defense mechanism is undergoing its biggest structural shift in years.

According to a deep dive published on the Chromium Blog, the Chrome Security team is now deploying custom Gemini-powered agent harnesses alongside specialized AI tools from Google DeepMind and Project Zero. The push is yielding immediate results: across the Chrome 149 and 150 release milestones, Google squashed 1,072 security bugs, which is more than the combined total of the previous 23 milestones. The automated pipeline even flagged a high-severity sandbox escape bug that had quietly survived in Chrome’s codebase for over 13 years.

To manage the sudden influx of bug reports (which surged past 2025’s total volume by March 2026), Google automated its triage and patching pipelines, with multi-agent workflows now handling the heavy lifting. “Fixing agents” draft potential candidate code, while separate “critic agents” evaluate the patches against Chromium standards, and “test-writing agents” generate cross-platform test suites. Integrated directly into Google’s continuous integration setup, these models scan every commit every 24 hours, blocking over 20 vulnerabilities (including a critical S1+ flaw) from reaching production in May alone.

Behind the scenes, Google is also tackling memory safety, one of the root causes for high-severity browser vulnerabilities. While the team continues to harden legacy C++ code, Google’s long-term architectural solution is a migration toward memory-safe languages like Rust.

However, discovering and fixing a bug only solves half the problem. Once a patch lands in Chrome’s public open-source codebase, attackers race to reverse-engineer it to exploit unupdated browsers, a window known as the “patch gap.” To shrink this vulnerability window, Google is piloting a shift to two security releases per week, down from its typical weekly update schedule.

Getting updates shipped quickly is useless if users delay applying them. People naturally postpone restarting their browsers to avoid interrupting their active workflows, leaving their machines exposed to exploits. To fix this without frustrating users, Google is pioneering “dynamic patching,” a method that leverages Chrome’s multi-process architecture to hot-swap background processes such as the Renderer and GPU on the fly, without a full browser restart.

Additionally, Chrome on macOS now uses windowless background states to trigger silent auto-restarts, moving toward a future in which browser security updates happen continuously, seamlessly, and entirely in the background.