Chrome ai bug hunting has pushed Google’s browser team into a faster patch cycle, with the company now piloting security updates twice a week after a flood of vulnerability fixes.
In a report published Thursday, Google’s Chrome security team said two major Chrome releases in June carried fixes for 1,072 security bugs. Google said that was more than the number of security patches shipped across the previous 23 major releases combined.
Some of those flaws came from outside researchers, according to Google. The bigger change, the Chrome team said, is inside Google: engineers are using AI systems more heavily to find bugs, sort reports and help develop fixes. That has turned the patch queue from a stream into something closer to a burst pipe.
Why is Chrome getting security updates twice a week?
Chrome is already headed toward a regular schedule of major releases every two weeks, with extra security updates each week. Doug Turner, Chrome’s director of engineering, told WIRED that the current pileup of vulnerability fixes made two security releases per week the practical choice for now.
Turner did not say the pace would become permanent. He told WIRED the team does not know whether the twice-weekly schedule will last.
Parisa Tabriz, Chrome’s vice president and general manager, told WIRED that Google has used machine learning in Chrome security work since at least 2012, including for vulnerability discovery and automated fuzz testing. Fuzz testing throws unexpected or malformed inputs at software to see where it crashes, leaks data or behaves in ways developers did not intend.
Tabriz said 2026 feels different because AI is changing both attack and defense. In plain English: the same class of tools that helps defenders search a giant codebase can also help attackers look for mistakes faster than before.
How Google says its AI bug hunting works
Turner told WIRED that Google is training its model on the security history of Chrome and Chromium. He said the model knows about every CVE and every bug Google has seen, and that it also has context for every line of code in Chromium’s history, including why that line changed.
That historical map matters for a project the size of Chrome. Google says AI tools can point engineers toward suspicious code paths in old or complicated features, including parts of the browser that are no longer being actively built and may get less routine human attention. Turner gave printing as an example.
The current spike may not continue at the same rate, according to Turner. For mature software such as Chrome, he told WIRED, there may be a drop-off after AI-assisted systems find and developers fix the easier-to-detect backlog of bugs.
Google is also trying to reduce the number of bug classes Chrome can have in the first place. Tabriz and Turner told WIRED the team is working on design changes, including moving some C++ code into Rust, a programming language commonly described as memory safe. Memory safety matters because many serious browser bugs come from programs mishandling how memory is allocated, reused or freed.
Tabriz told WIRED she expects a new balance after the near-term spike, but warned that better security will not arrive automatically. Companies building software, she said, need to put AI into their security and development work rather than assuming the tools will clean up the mess on their own.
This story draws on original reporting from WIRED.
