1,072 security bugs patched in a single month. More than the previous 23 Chrome releases combined. One of them had been hiding in the browser for 13 years. Google says AI did what two years of human security work could not.
For roughly three billion people who use Chrome every day, the browser just got significantly safer — and it happened in an unusually compressed timeframe. On July 30, 2026, Google’s Chrome Security Team announced that Chrome versions 149 and 150, both released in June, collectively patched 1,072 security vulnerabilities. The previous 23 Chrome releases — covering roughly two years — had patched a combined total of 1,036. Two months of AI-powered security work outpaced two years of the previous approach.
The milestone is the most specific public accounting yet of what AI-driven security looks like when it matures from experiment to industrial operation. Google has been building its Gemini-powered vulnerability discovery pipeline since 2023. What happened in June 2026 represents the moment that investment compounded into results that the previous process could not have produced at any pace.
How the AI Pipeline Works
The 1,072 fixes did not come from a single clever model. They came from a multi-stage, multi-agent system Google has been refining since first deploying it in 2023. The system works through several phases: AI agents continuously scan Chromium’s entire codebase for vulnerability patterns, applying knowledge of every security flaw Chrome has ever seen and every line of code change in the browser’s history. When a potential bug is identified, a separate layer triages it — filtering false positives, assessing severity, and proposing specific code fixes. A final layer reviews the proposed patches for correctness before they are submitted for human sign-off.
Doug Turner, Chrome’s director of engineering, described the cumulative effect to TechCrunch: “Large language models have fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation. By applying models like Gemini, we can systematically scan codebases at a rate and breadth that human researchers cannot match.” The encyclopedic memory of the AI — every historical vulnerability, every code revision — lets it identify weaknesses in corners of the codebase that have not attracted human attention in years, including features like printing that are no longer under active development.
One of the most striking specific finds: a 13-year-old sandbox escape vulnerability that had been sitting undetected in Chrome’s code since 2013. A sandbox escape is one of the most serious categories of browser vulnerability — it is the type of flaw that, if combined with other bugs, could let an attacker break out of the browser’s isolated execution environment and access the underlying operating system. The bug had survived more than a decade of human security review. The AI found it.
“Large language models have fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation.”
— Doug Turner, Director of Engineering for Chrome, Google
When the Bug Reports Exceeded Human Triage Capacity
The 1,072 June fixes were not just the product of Google’s internal AI pipeline. They also reflect a change in the Chrome Vulnerability Reward Program — the external bug bounty scheme through which security researchers outside Google are paid for finding and responsibly disclosing Chrome vulnerabilities. By March 2026, Google was receiving more AI-generated external bug reports in a single month than it had received in all of 2025. The volume had outpaced the capacity of the existing review process.
Google restructured the program in response — redesigning the triage workflow, adjusting reward criteria, and scaling its internal capacity to process reports that were arriving at a pace that had no historical precedent. The restructuring is itself evidence of a broader shift: AI-powered vulnerability discovery has not just accelerated Google’s own security work. It has accelerated the entire researcher ecosystem that reports bugs to Google, and the resulting flood of reports required institutional adaptation.
Google Is Not Alone — But Apple Seems to Be on a Different Path
Google’s June milestone landed the same month Microsoft announced its own record: 570 security flaws patched across its product lines in a single Patch Tuesday — the monthly security update cycle Microsoft has run for two decades. Microsoft also cited AI as the driver of the jump, citing similar tools scanning its codebases at a scale that human teams cannot replicate. Together, the two announcements represent a notable convergence: the two largest contributors to the global browser and operating system market are both reporting AI-driven step-changes in security patch volume, in the same month.
Apple, by contrast, is not showing the same trend. An independent count put Apple’s 2026 security fixes at 482 as of July — roughly on pace to match its 2025 total, and roughly equal to the number of bugs Apple fixed in 2015. Apple has not adopted the same aggressive AI-assisted vulnerability discovery approach that Google and Microsoft have publicly disclosed, and it did not respond to TechCrunch’s request for comment. The divergence is striking: two of the three dominant platform vendors are reporting exponential AI-driven security improvements; the third appears to be patching at the pace it always has.
The Boom May Not Last Forever
Turner offered an important caveat to the milestone’s longer-term trajectory when speaking to Wired. For mature, stable products like Chrome, he said he sees evidence that the vulnerability boom may have a natural ceiling. Once AI has found the bulk of bugs that it can identify with current techniques — particularly in well-reviewed, stable codebases — the discovery rate will likely plateau. You cannot find a bug twice, and a codebase that has been swept systematically by AI has fewer remaining targets with each pass.
Google is already working on what comes after the initial discovery wave: dynamic patching — a system that would deliver security fixes to Chrome users without requiring a full browser update. Rather than bundling fixes into the six-week Chrome release cycle, dynamic patches could go out continuously as vulnerabilities are found and fixed. For users, the practical implication would be that their browser gets safer on an ongoing basis rather than in periodic steps — a shift in the browser security model that the AI-driven acceleration of discovery has made both more valuable and more urgent.
What It Means for the 3 Billion People Who Use Chrome
For the people who simply use Chrome to browse the internet, the June milestone is almost entirely good news. More bugs found and fixed means a safer browser. Bugs found in months rather than years means less time during which an attacker could theoretically discover and exploit the same vulnerability. A 13-year-old sandbox escape fixed in 2026 is better than a 13-year-old sandbox escape fixed never.
The more nuanced question — one that Turner’s comment about the boom potentially not lasting forever gestures toward — is whether the current surge represents a durable new capacity or a one-time clearing of the backlog. If it is the latter, the browser security landscape looks very different in two years: most of the discoverable bugs have been found, the discovery rate normalises, and the question becomes less about finding vulnerabilities and more about writing code that does not contain them in the first place. That is a problem AI is also being asked to solve — and its track record there, so far, is considerably more complicated.
