Google's Gemini AI Helps Chrome Fix More Security Bugs in Two Months Than the Previous Two Years Combined

Chrome deployed Gemini-powered vulnerability discovery, triage, and patching at scale, fixing 1,072 security bugs in releases 149 and 150 — surpassing the total fixed across the prior 23 releases combined.

Google's Chrome Security team has revealed the staggering impact of deploying Gemini AI across its vulnerability management pipeline: the browser fixed 1,072 security bugs in its last two release milestones, surpassing the total number of security bugs fixed across the prior 23 releases combined.

The system, detailed in a Google Security Blog post, uses LLMs across the entire bug lifecycle — from discovery to triage to automated patch generation. One of the more striking finds was a sandbox escape vulnerability that had survived in the Chrome codebase for 13 years before Gemini's agent harness caught it.

"Every bug found and fixed is one less foothold for an attacker," the team writes. The automated triage pipeline alone saves hundreds of developer hours per month, and LLMs now generate candidate fixes for most vulnerabilities.

The acceleration is forcing operational changes. Chrome is piloting two security releases per week — up from its current biweekly cadence — and is working toward a browser that patches itself dynamically with minimal user disruption. Google is also investing in memory-safe language migration, with Rust increasingly replacing C++ components for long-term architectural resilience.

The AI-driven approach also found a sandbox escape in Chrome's renderer that could trick the browser into reading local files — a bug that had lurked undetected since 2013. The team says AI-powered fuzzing complements but doesn't replace traditional methods like human bug bounty programs, which continue to surface the most creative exploits.

The Google blog post is the official source for this data. Chromium's public bug tracker and release notes corroborate the sharp increase in security fixes across recent milestones.

Sources: Google Security Blog, Chromium Releases