Google patched more security vulnerabilities in its Chrome browser during a single month this June than it had in the previous two years combined, a milestone that the company attributes directly to its internal deployment of large language models and AI-powered code analysis tools. The disclosure, published Thursday alongside a white paper detailing Google’s evolving approach to automated vulnerability discovery, reveals that Chrome’s two most recent releases — versions 149 and 150, both shipped in June — collectively fixed 1,072 security bugs. That figure eclipses the 1,036 flaws remediated across the preceding 23 milestone releases, which spanned roughly two years of development and updates.
The numbers represent more than a statistical anomaly. They signal a structural shift in how one of the world’s most widely used software platforms identifies and eliminates security weaknesses before attackers can exploit them. For years, cybersecurity researchers warned that the arrival of capable large language models would dramatically accelerate the rate at which vulnerabilities could be discovered — and that defenders would need to adopt the same technology simply to keep pace. Google’s latest data suggests that future has arrived, and it is already reshaping the economics of browser security.
The 1,072-Bug June: How Chrome’s AI-Driven Patching Broke Every Previous Record
To understand the scale of what Google accomplished in June, it helps to examine the historical baseline. Chrome’s development cycle is organized around “milestone” releases — numbered versions that ship approximately every four weeks. Each milestone typically includes a mix of feature improvements, performance enhancements, and security fixes. Over the two years preceding June, Google’s engineers had patched 1,036 security bugs across 23 such milestones. That averages out to roughly 45 fixes per release, a cadence that had remained relatively stable for years.
Then came versions 149 and 150. Between them, Google fixed 1,072 security flaws — more than double the number of bugs patched in the entire previous year, and slightly more than the total for the prior two years combined. The jump is not a gradual upward trend; it is an inflection point. A chart published by Google as part of its white paper illustrates the change in stark terms: a flat line extending across dozens of milestones, followed by a near-vertical spike at the 149 and 150 markers.
Google calls each numbered release a “milestone.” Chrome 126, for context, was released in June 2024. The company’s engineering team has since accelerated the release cycle, and the latest two milestones — 149 and 150 — represent the first full releases where AI-assisted vulnerability discovery was operating at scale across the entire Chrome codebase.
What Changed Inside Google’s Engineering Pipeline
The jump did not happen because Chrome suddenly became more insecure. It happened because Google’s internal tooling, powered by its Gemini family of large language models, began identifying vulnerabilities that had previously gone undetected — some of them dormant in the codebase for years. Doug Turner, Chrome’s director of engineering, told TechCrunch that large language models have “fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation.”
That phrasing is carefully chosen. The economics of vulnerability discovery have historically favored attackers: a single researcher or group could spend weeks hunting for a critical flaw, while defenders had to prioritize the most likely attack vectors across millions of lines of code. AI changes that calculus by allowing automated systems to scan code paths, identify anomalous patterns, and flag potential weaknesses at a speed and scale that human teams cannot match. Google’s internal deployment of Gemini-based tools appears to have automated not just the discovery phase but also parts of the triage and remediation process, enabling the company to fix more bugs in a single month than it had in two years of conventional development.
“By applying models like Gemini, we are preemptively fixing vulnerabilities, outpacing our adversaries and making Chrome safer with every update,” Turner said.
How AI Transforms Vulnerability Discovery Into an Industrial-Scale Operation
The mechanism behind Google’s record-breaking June is worth examining in detail, because it represents a template that other software vendors are likely to follow. Traditional vulnerability discovery relies on a combination of manual code review, fuzzing (automated input generation designed to crash software), and external bug bounty programs. All three approaches have limitations. Manual review is slow and expensive. Fuzzing can miss logic flaws that do not trigger crashes. Bug bounties depend on external researchers finding vulnerabilities before attackers do, and the payouts can be inconsistent.
Large language models offer a fundamentally different approach. Instead of randomly mutating inputs or relying on human intuition, AI models trained on vast corpora of code can learn to recognize patterns associated with common vulnerability classes — buffer overflows, use-after-free errors, type confusion, improper input validation, and others. Once trained, these models can analyze entire codebases systematically, flagging suspicious code paths for human review or, in some cases, generating patches automatically.
Google’s white paper does not disclose every detail of its internal tooling, but the company has previously published research on using LLMs for fuzzing, static analysis, and patch generation. The jump in Chrome’s bug-fix numbers suggests that these techniques have been productized and integrated into the development pipeline for Chrome’s two most recent releases. The result is not merely a higher volume of fixes but a shift toward proactive rather than reactive security. Instead of waiting for external researchers or attackers to find flaws, Google is finding them internally — and fixing them before they appear in any bug bounty report or exploit kit.
What This Means for Chrome’s Bug Bounty Program
One immediate consequence of this shift is that Google’s bug bounty program may see a decline in valid submissions from external researchers for certain classes of vulnerabilities. When AI tools are systematically scanning the same codebase that external researchers target, the low-hanging fruit gets picked first. This does not mean bug bounties will disappear — skilled human researchers will always be able to find flaws that automated tools miss — but it does mean that the economics of vulnerability discovery are changing. Google is effectively internalizing a large portion of the discovery process that previously relied on external incentives.
For security researchers who participate in Chrome’s bug bounty program, the implication is clear: the competition is no longer just other researchers; it is an AI model that never sleeps, never gets distracted, and can analyze the entire Chrome codebase in a fraction of the time a human would need. Researchers who want to stay ahead will need to focus on deeper, more complex vulnerabilities that require contextual understanding beyond what current LLMs can achieve.
Microsoft Follows the Same Playbook: Record Patch Tuesday Tied to AI
Google is not alone in reporting an AI-driven spike in vulnerability fixes. Earlier this month, Microsoft announced that it had patched a record 570 security flaws across its product lines as part of its monthly Patch Tuesday cycle. Microsoft explicitly cited its own use of AI tools to explain the sudden increase. The number of flaws patched in that single month was significantly higher than the company’s historical average, and the pattern mirrors what Google experienced in Chrome.
The coincidence is not accidental. Both companies have invested heavily in AI-powered code analysis, and both have reached a point where those investments are producing measurable results. For Microsoft, the 570-fix Patch Tuesday represents a new high-water mark in a program that has been running for decades. For Google, the 1,072-bug month in Chrome represents an even more dramatic departure from historical norms.
Together, these two data points suggest that the software industry is entering a new phase of vulnerability management. The rate at which flaws are discovered and fixed is no longer constrained by the number of human reviewers or the creativity of external researchers. It is constrained by the throughput of AI models and the ability of engineering teams to triage and apply the patches they generate.
Why Apple Has Not Seen the Same Exponential Increase
Not every major technology company is registering the same acceleration. Apple, according to an independent count of bugs fixed in its products compiled on GitHub, has patched 482 vulnerabilities so far in 2026. That pace is roughly on track to equal or slightly surpass the number of bugs Apple fixed in the full year of 2025, and it is also roughly comparable to the number of bugs Apple patched in 2015. There is no exponential spike in Apple’s data.
TechCrunch reached out to Apple for comment on this discrepancy but did not receive a response. Several possible explanations exist. Apple may not have deployed AI-powered vulnerability discovery tools at the same scale as Google and Microsoft. The company may be using AI internally but not yet seeing the same results because its codebase is structured differently. Or Apple may be counting and disclosing vulnerabilities differently, making direct comparisons difficult.
Regardless of the reason, the contrast is instructive. It shows that the AI-driven acceleration in vulnerability discovery is not an automatic consequence of adopting AI tools. It requires deliberate investment in model training, pipeline integration, and engineering workflow changes. Companies that have not made those investments will not see the same results.
The New Economics of Browser Security: Why Volume Matters
Critics might argue that patching more bugs does not necessarily mean Chrome is becoming more secure. It is theoretically possible that AI tools are simply finding more low-severity issues that would never have been exploited, inflating the numbers without meaningfully improving the security posture. But that interpretation does not hold up under scrutiny.
First, Google’s white paper indicates that the vulnerabilities found by AI tools span the full severity spectrum, including critical and high-severity flaws that could allow remote code execution or sandbox escape. Second, even low-severity bugs can be chained together by skilled attackers to achieve more dangerous outcomes. The elimination of any vulnerability reduces the attack surface. Third, the sheer volume of fixes suggests that Google is finding vulnerabilities that were previously invisible to existing detection methods — including some that may have been present in the codebase for years.
From a strategic perspective, the volume of fixes matters because it changes the timeline of vulnerability discovery. In the traditional model, a vulnerability might remain undiscovered for months or years before a researcher or attacker finds it. In the AI-assisted model, Google is finding those same vulnerabilities during development or shortly after release, before they can be weaponized. The window of opportunity for attackers shrinks.
What Is a Milestone Release and How Does Chrome’s Versioning Work?
For readers unfamiliar with Chrome’s development cycle, a brief explanation is useful. Chrome uses a “milestone” numbering system for its major releases. Each milestone — such as Chrome 126, Chrome 149, or Chrome 150 — represents a complete version of the browser that includes new features, performance improvements, and security fixes. Milestones are released approximately every four weeks, though the exact cadence can vary.
The transition from Chrome 126 (released in June 2024) to Chrome 149 and 150 (released in June 2026) represents roughly two years of development across 23 intermediate milestones. The fact that the two most recent milestones alone fixed more security bugs than all 23 previous milestones combined is what makes Google’s announcement so striking. It is not a small improvement; it is a step change in the rate of vulnerability remediation.
How Google’s AI Tools Find Bugs: A Closer Look at the Technical Approach
Google has not published a detailed technical breakdown of the specific AI tools used to achieve the 1,072-fix month, but the company’s broader research provides strong clues. Google has been developing AI-powered fuzzing tools that use large language models to generate more intelligent test inputs. Instead of random mutations, these tools learn from the codebase itself, generating inputs that are more likely to trigger edge cases and uncover vulnerabilities.
Google has also published research on using LLMs for static analysis — scanning source code without executing it — to identify patterns associated with known vulnerability classes. This approach is particularly effective for finding bugs that fuzzing might miss, such as logic errors that only manifest under specific conditions or vulnerabilities that require multi-step exploitation.
Additionally, Google has explored using LLMs to generate patches automatically. Once a vulnerability is identified, the model can propose a fix, which a human engineer then reviews and tests. This dramatically reduces the time between discovery and remediation, which is critical for vulnerabilities that could be actively exploited.
The combination of AI-powered discovery, triage, and patching creates a pipeline that can process vulnerabilities at a rate that was previously unimaginable. The 1,072 bugs fixed in Chrome 149 and 150 are the output of that pipeline operating at full capacity for the first time.
What Does This Mean for Chrome Users?
For the approximately 3.3 billion people who use Chrome worldwide, the practical implication is straightforward: their browser is becoming more secure, and it is becoming more secure faster than ever before. Each new milestone release will contain a larger number of security fixes than users have come to expect, and those fixes will address vulnerabilities that might otherwise have remained hidden for years.
Users do not need to take any special action beyond keeping Chrome up to date. Chrome updates automatically in most cases, but users who have disabled automatic updates or who are running outdated versions should ensure they are on the latest milestone to benefit from the accelerated pace of patching. Enterprise administrators who manage Chrome deployments at scale should prioritize testing and deploying the latest milestones as quickly as possible, given the volume of security fixes they contain.
The Strategic Implications for the Cybersecurity Industry
Google’s announcement, coming just weeks after Microsoft’s record Patch Tuesday, sends a clear message to the broader cybersecurity industry: the era of AI-assisted vulnerability discovery is here, and it is transforming the defensive landscape. Companies that invest in AI-powered security tooling will be able to find and fix vulnerabilities at a rate that significantly outpaces companies that rely on traditional methods.
This creates a competitive dynamic. Software vendors that lag in AI adoption will find themselves at a growing disadvantage, not just in terms of security but also in terms of reputation and trust. Customers, particularly in enterprise and government sectors, are increasingly demanding evidence that the software they use is being proactively secured. AI-assisted vulnerability discovery provides that evidence in the form of data — numbers of bugs found and fixed, reduction in attack surface, and shortening of the window between discovery and patch.
For the cybersecurity workforce, the implications are mixed. On one hand, AI tools are automating tasks that previously required highly skilled human analysts, potentially reducing demand for certain roles. On the other hand, the volume of vulnerabilities being discovered means that human expertise is still needed for triage, validation, and remediation of the most complex issues. The role of the security engineer is shifting from manual code review to AI oversight and exception handling.
Will AI-Driven Patching Lead to Fewer Zero-Day Exploits?
One of the most important questions raised by Google’s announcement is whether AI-driven vulnerability discovery will reduce the number of zero-day exploits — vulnerabilities that are exploited before the vendor has a chance to patch them. The logic is straightforward: if Google is finding and fixing vulnerabilities faster, there should be fewer exploitable flaws available to attackers.
In theory, yes. In practice, the answer is more nuanced. Attackers also have access to AI tools, and they are likely using them to find vulnerabilities in the same software that Google is defending. The race between offense and defense is accelerating on both sides. What Google’s data shows is that the defensive side is gaining ground — at least for now. The company is finding more bugs internally than it has ever found before, which suggests that the pool of undiscovered vulnerabilities is being depleted faster than attackers can exploit them.
But the race is not over. As AI models improve, attackers will find new ways to identify vulnerabilities that current models miss. The long-term outcome depends on which side can innovate faster and deploy its tools more effectively. Google’s June data is a snapshot of a dynamic process, not a final verdict.
What the Next Year of Chrome Security Will Look Like
If the current trend continues, Chrome’s next several milestone releases will each contain hundreds of security fixes rather than the dozens that users have historically seen. Google’s engineering team will need to scale its patch review and testing processes to handle the increased volume without introducing regressions or breaking changes. The company’s investment in AI-assisted patching will be critical to managing that workload.
External security researchers who participate in Chrome’s bug bounty program will need to adapt to a landscape where the easiest vulnerabilities are being found by AI. The most valuable contributions will come from researchers who can identify complex, multi-step vulnerabilities that require deep understanding of Chrome’s architecture — the kinds of bugs that current LLMs are not yet capable of finding reliably.
For users, the message is simple: keep Chrome updated, and recognize that each update is bringing a level of security improvement that was not possible just a few years ago. The 1,072 bugs fixed in June are not a sign that Chrome is becoming less secure. They are a sign that the tools available to secure it are becoming dramatically more powerful, and that Google is using them to stay ahead of the threats that evolve with every passing day.
