Software · 31 July 2026 · 3 min read

AI Bug Hunting Overwhelms Chrome Security: Over 1,000 Flaws Fixed in One Month as Twice-Weekly Patching Begins

In brief: In June, Chrome releases 149 and 150 delivered 1,072 security bug fixes, eclipsing the total from the previous two years combined. The integration of large language models into internal vulnerability discovery has accelerated bug detection to the point where Google is now testing twice-weekly security updates and zero-restart dynamic patching.

by Team Mocchi's

The algorithmic vulnerability boom

In June 2026, Google’s Chrome security team achieved an unprecedented milestone: the deployment of milestone versions 149 and 150 delivered patches for 1,072 security vulnerabilities. As reported by TechCrunch, this single month of releases exceeded the total number of security flaws remediated across the previous 23 browser versions over the past two years combined, which stood at 1,036 total fixes.

This dramatic surge represents a fundamental shift rather than an incremental upgrade. Doug Turner, Chrome’s director of engineering, noted that applying advanced AI models has turned vulnerability discovery into an automated, industrial-scale cybersecurity operation. By analyzing massive codebases at unprecedented speed, engineering teams are reversing traditional defender disadvantages and exposing deep-seated flaws that human security audits had consistently missed.

Training LLMs on historical codebases

The catalyst behind this patch wave is not mere automated fuzz testing—a practice in use for over a decade—but the integration of specialized LLM architectures (such as Google's Gemini models) fine-tuned on Chromium’s complete repository history. As detailed by WIRED, Google’s internal AI tools hold an encyclopedic understanding of every historical CVE and every commit rationale ever logged in the project's history.

This deep historical context allows AI agents to audit legacy components and rarely reviewed subsystems, uncovering logical oversights and memory corruption vulnerabilities that have laid dormant for years. Among the discoveries from this intensive AI-driven campaign was a high-severity sandbox bypass bug that had persisted undetected in Chrome's codebase for 13 years, which could have allowed an attacker to break out of the browser sandbox to access local files.

The release dilemma: twice-weekly updates and zero-restart patches

Accelerated bug discovery introduces an immediate operational challenge: discovering vulnerabilities faster than patches can be deployed leaves users exposed to automated exploit generation by malicious actors. In response, Google is piloting an aggressive release cadence, testing security patch rollouts up to twice per week, shifting away from standard monthly or bi-weekly update cycles.

However, increasing update frequency creates update fatigue for end users, many of whom delay restarting their browsers. As explained by Ars Technica, Google is actively testing frictionless patching mechanisms. On macOS, Chrome now utilizes a "zero window restart" mechanism that updates the app in the background once foreground windows are closed. For long-term protection, Google is investing in "dynamic patching," an in-memory hotfixing architecture designed to apply security updates on the fly without restarting the application.

Mocchi's take

Google's milestone with Chrome previews a structural transformation that will reshape software development across every enterprise domain. The ability of large language models to systematically audit complex codebases for security vulnerabilities will not remain exclusive to tech giants—it is rapidly becoming an essential capability for any organization managing custom software or enterprise SaaS platforms.

For software development teams and tech leaders, this shift requires two clear strategic adaptations. First, embedding AI-assisted static analysis and automated fuzzing directly into CI/CD pipelines must become a standard practice to catch vulnerabilities before code reaches production. Second, application deployment architectures must evolve toward zero-downtime hotfixing. As the time window between vulnerability discovery and automated exploitation collapses to hours, maintaining software resilience requires release engineering that can ship security patches instantaneously without disrupting the user experience.

All articles on the Mocchi's blog