Google says it fixed more Chrome bugs in June via AI

Google has reached a significant milestone in automated software maintenance, reporting a massive surge in vulnerability remediation within its flagship browser. In a recent technical disclosure, Google says it fixed more Chrome bugs in June 2026 than it managed to resolve over the previous two years combined. This achievement, spanning Chrome versions 149 and 150, is being attributed to a fundamental shift in how the company utilizes Artificial Intelligence (AI) and Large Language Models (LLMs) for proactive code analysis.

The Data Behind the Surge: 1,072 Fixes in 30 Days

The statistical leap in Chrome’s security posture is quantified by a sharp deviation from historical norms. Throughout the previous 23 versions of Chrome—roughly covering a 24-month period—Google’s security teams patched a total of 1,036 bugs. In June 2026 alone, that figure rose to 1,072 security-specific patches.

This acceleration is largely credited to the “Big Sleep” project, a collaborative effort between Google Project Zero and Google DeepMind. By leveraging specialized LLMs trained on vast repositories of C++ code and historical exploit data, Google has moved beyond traditional “fuzzing”—a process that sends random data to an application to trigger crashes—toward intelligent, context-aware bug hunting.

Solving the 13-Year-Old Sandbox Escape

Perhaps the most compelling evidence of AI’s efficacy is the discovery of a “hidden” vulnerability that had persisted in the Chrome codebase since 2013. The AI-driven system identified a complex sandbox escape bug that could allow an attacker to bypass the browser’s primary security layer and execute code on the underlying operating system.

Traditional automated tools and human auditors missed this flaw for over a decade because it required a specific sequence of memory corruption events that appeared benign in isolation. The LLM’s ability to reason across large code modules allowed it to simulate potential exploit paths that were previously deemed too computationally expensive to map. This mirrors recent industry concerns where AI models have been used to identify exploits in other major platforms like Hugging Face.

How AI Differs from Traditional Fuzzing

• Semantic Understanding: While traditional tools look for crashes, LLMs look for logic flaws and architectural inconsistencies.
• Exploit Simulation: AI can generate “proof-of-concept” code to verify if a bug is actually exploitable, reducing the time developers spend on false positives.
• Legacy Code Analysis: AI is uniquely suited to scanning ancient parts of the Chrome engine (Blink and V8) that modern developers may be less familiar with.

The Double-Edged Sword of AI Vulnerability Research

While the internal report highlights a victory for Google’s defense teams, the data also serves as a cautionary tale for the cybersecurity industry. The fact that Google says it fixed more Chrome bugs in a single month than in two years suggests two possibilities: either the software is becoming more secure at an exponential rate, or our previous methods of detection were severely inadequate.

There is also the looming risk of “asymmetric AI warfare.” If Google can use LLMs to find 1,000 bugs in a month, sophisticated threat actors can use similar models to find “Zero-Day” vulnerabilities before a patch is even conceived. We have already seen instances where sensitive data is inadvertently exposed through AI-integrated platforms, such as the incident where Claude shared chats were exposed in Google Search, illustrating that AI itself often introduces new surfaces for error.

Integration into Chrome Versions 149 and 150

The patches generated during this June surge have been integrated into the stable releases of Chrome 149 and the early beta of Chrome 150. Users are urged to verify their browser version to ensure these critical AI-discovered fixes are active. Unlike previous updates that focused heavily on UI changes or performance tweaks, these versions represent a heavy “security-first” pivot for the Chromium project.

As Google continues to refine its LLM-based security pipeline, the industry can expect a “new normal” where the volume of CVEs (Common Vulnerabilities and Exposures) increases significantly. This doesn’t necessarily mean software is getting “buggier,” but rather that the “dark matter” of undiscovered vulnerabilities is finally being illuminated by machine intelligence. The challenge for Google now lies in ensuring that the sheer volume of fixes does not introduce new regressions in browser stability.