AI Floods Chrome With 1,072 Security Bug Fixes in June

Chrome AI bug fixes are no longer a lab demo. They are turning software security into a throughput contest, where the winner is the company that can find, triage, patch, and ship faster than attackers can reverse-engineer the fix.

Google said it fixed 1,072 security bugs in the last two versions of Chrome, both released in June, which is more than the 1,036 fixes across the previous 23 versions over roughly two years, according to TechCrunch. The company credits internal AI tools, including models such as Gemini, for the surge.

That is good news for users. It also exposes the uncomfortable part of the AI security story: mature software may be carrying far more dormant vulnerabilities than traditional discovery systems were surfacing.

Chrome's AI bug surge turns security into a volume game

Google’s July 30 announcement about June’s Chrome releases marks a sharp break from the old security rhythm. For years, browser security depended on a mix of internal review, external researchers, bug bounty programs, fuzzing, scheduled audits, and emergency fixes when serious flaws surfaced. That model still matters, but Google’s numbers show it can now be overwhelmed by AI-assisted discovery.

Doug Turner, Chrome’s director of engineering, framed the shift bluntly:

LLMs have “fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation.”

Google says it is applying models like Gemini to “preemptively” fix vulnerabilities and “outpacing our adversaries.” XOOMAR analysis: that language matters because it recasts browser security as a production pipeline problem. Finding bugs is no longer the scarce step. The scarcer resource becomes clean validation, safe patching, and fast delivery to users.

The twist is that a record fix count can look both reassuring and alarming. More Chrome AI bug fixes mean Google is closing holes faster. They also suggest that older code paths, including parts of Chrome that survived years of scrutiny, can still hide serious issues until a new class of tools starts looking.

The June numbers dwarf the previous two years of Chrome fixes

The headline number is stark: 1,072 security bugs fixed in Chrome 149 and Chrome 150, versus 1,036 across the prior 23 milestones. Google calls each Chrome version a “milestone.” For context, TechCrunch notes that Chrome 126 was released in June 2024, while Chrome 149 and 150 were released last month.

A clarification matters here. Google’s own security write-up distinguishes ordinary software bugs from security bugs. A functional bug might freeze an interface. A security bug can become a path to an exploit, including reading private data or controlling a machine without the user’s knowledge.

That makes the Chrome figure more serious than a raw quality-control metric. These are security fixes, not merely cosmetic repairs.

Still, XOOMAR analysis: volume alone does not prove Chrome suddenly became less secure. It may prove Google became much better at finding what was already there. That is why vulnerability counts will become harder to interpret as AI tools scale. A rising count can mean worsening code quality, stronger discovery, or both.

Google and Microsoft show AI can flood mature codebases with findings

Google is not alone. Earlier this month, Microsoft said it patched a record 570 security flaws across its product lines during its monthly scheduled patch cycle, commonly called “Patch Tuesday,” and cited its own use of AI to explain the jump, according to the same TechCrunch report.

Apple does not appear to show the same exponential pattern. TechCrunch cites an independent count showing Apple has patched 482 bugs in 2026, roughly on pace to equal or exceed last year’s number and roughly equal to the number Apple patched in 2015. TechCrunch said it contacted Apple for comment and did not hear back.

Browsers are especially exposed to this shift because they process hostile inputs constantly and sit on large, old, complicated codebases. Google’s own Chrome Security Team said it built an AI agent harness in early 2026 that used Gemini to find vulnerabilities across the broader Chrome codebase with higher efficiency and lower false positives. One bug it found was a sandbox escape that had survived for more than 13 years.

AI is not replacing old methods. Google says fuzzing remains especially useful for finding bugs that arise from long-range interactions across separate parts of the codebase. The stronger reading is that LLMs are becoming another layer in the stack, one that can scan, summarize, generate tests, and point engineers toward suspicious patterns at a pace manual review cannot match.

Bug bounties now compete with internal LLM scanners

The past two years changed the center of gravity in vulnerability hunting. Google says its Chrome Security team has used LLMs for years, including work in 2023 to improve security fuzzing coverage and performance, 2024 work with Project Zero on Naptime, and 2025 collaboration with DeepMind and Project Zero on Big Sleep, an AI vulnerability discovery agent that found bugs in the V8 JavaScript engine and graphics stack.

By early 2026, Google’s internal tooling had moved beyond experiments. It built a knowledge base covering Chrome, including previously identified CVEs and Chrome’s full Git history. It added SECURITY.md files to help models understand trust boundaries, created a separate “critic” agent, and ran vulnerability-finding models repeatedly to account for model non-determinism and model improvement over time.

That changes the role of outside researchers. Google said that by March, it had received more bug reports than in the entirety of 2025, prompting changes to the Chrome Vulnerability Reward Program so researchers focus on reports that add to what Google finds internally and can be ingested by automated pipelines.

For broader context on defensive AI moving from vendor talking point to security operating model, see XOOMAR’s related coverage of the Nvidia AI Security Alliance and the managed security market pressure behind the $110M Inforcer Series C.

Users get faster fixes, engineers get a triage crisis

For users, the best version of this story is simple: safer Chrome builds arrive faster. Google’s security life cycle is find, triage, fix, release, restart, and apply the update. Every acceleration in that chain can reduce the time a known vulnerability remains exploitable on real machines.

For Google engineers, the problem shifts. AI can produce more findings than legacy processes were designed to absorb. That forces heavier automation in triage, reproduction, metadata enrichment, patch drafting, and testing. The company says it uses guardrails, including locked-down machines without general internet access, intercepted network requests, strict allowlists, and limits on subagents modifying local systems or accessing files outside designated source directories.

Enterprise IT teams face a different version of the same pressure. XOOMAR analysis: if vendors start shipping more security fixes more often, delayed browser patching becomes harder to defend. The source material does not provide enterprise adoption data, but the operational implication is clear enough: update visibility and restart behavior become part of the security control plane.

That ties directly to Google’s work on update friction. Android Authority, citing Google’s Chrome security material, reported that Google is piloting two security releases a week and working on “dynamic patching” to apply critical background updates without a full browser restart. XOOMAR has also covered this specific update problem in Chrome Dynamic Patching Targets the Relaunch Button.

Chrome AI bug fixes raise the bar for browser security metrics

The browser industry now has a measurement problem. If Chrome reports a surge in fixes because AI found more latent defects, a simple vulnerability count may punish transparency and better tooling. If a rival reports fewer fixes, that may mean cleaner code, weaker discovery, or less disclosure. The number alone won’t settle it.

Better metrics will need to focus on the full chain: how many serious findings are validated, how quickly patches ship, how often fixes cause regressions, how fast users receive updates, and how well model-generated changes are audited. Google’s own description points in that direction, with AI used not just for finding vulnerabilities, but also for triage and faster patching.

The strongest counterpoint is that AI security tooling still produces noise. Google’s emphasis on lower false positives, critic agents, rule-based filtering, and human-shaped workflows implicitly concedes that raw model output cannot be trusted blindly. That does not weaken the thesis. It sharpens it. The race is not to unleash models on code. It is to build a controlled factory around them.

The next Chrome security test is remediation, not discovery

The next phase for Chrome AI bug fixes will be judged by whether Google can keep converting AI-discovered vulnerabilities into reliable shipped patches without breaking compatibility or exhausting reviewers. More autonomous workflows are already visible in the source material: reproduction, triage, patch drafting, critic agents, and test generation.

XOOMAR analysis: expect more vendors to report elevated bug counts as AI tools uncover old defects that manual review missed. That scenario would support Google’s claim that LLMs have changed the economics of cybersecurity. The thesis would weaken if the surge turns into noisy disclosures, patch regressions, or findings that cannot be validated at scale.

The practical watch item is not which company finds the most flaws. It is which company proves it can run AI-assisted vulnerability discovery as a disciplined remediation pipeline: audited, restricted, repeatable, and fast enough that attackers lose the patch-gap race.

The Bottom Line

• Google’s AI-assisted fixes suggest vulnerability discovery is becoming faster and more automated.
• The surge implies mature software may contain many more dormant security flaws than older methods revealed.
• Browser security is shifting toward how quickly companies can validate, patch, and ship fixes before attackers react.