Record AI Bug Fixes Push Google To Twice-Weekly Chrome Updates
Google has begun piloting a twice-weekly update cadence for its massively popular Chrome web browser, a decision it made in the wake of fast-moving, AI-powered attacks. And for major Chrome milestones, the company is aiming to deliver new builds twice a month, along with weekly security updates, to ensure billions of users stay protected from surging AI threats.
One of the challenges for Google in the emerging AI threat landscape is that Chrome is open source. Why does this matter? Every time the developers fix a bug, the patch is made public right away. If bad actors can analyze those fixes faster than users install updates, the window of exposure gets dangerous. That's why Google is now testing a shift to twice-weekly Chrome releases.
1,072 Security Flaws In One Month
Source: Google
There are an inordinate number of bugs being fixed lately, many more than the dozens of security vulnerabilities patched in a typical month. Google said it patched a whopping 1,072 security flaws in Chrome 149 and the recently-released 150 builds combined. To put it into perspective, the number of bug patches in the past 30 days is more than the prior two years of browser releases combined.
The heavy lifting came from Gemini-powered security bots working alongside engines like Google's AI vulnerability hunter BigSleep and CodeMender. These systems scan raw code, hunt down memory flaws, and draft initial patches for engineers to review. In one case, the AI spotted a browser sandbox vulnerability that had sat untouched in Chrome's code for 13 years.
Speeding up bug discovery solves only half the problem, though. When Google fixes a flaw in Chromium's public repository, anyone running an AI tool can look at the commit, figure out how the bug works, and then build an exploit.
In the past, waiting a week between updates worked just fine, for the most part. However, hackers today are armed with automated models to reverse-engineer public patches in a matter of hours. Moving to two releases a week cuts down that exposure time before exploits hit the wild.
The other challenge for Google relates to update fatigue. It can be a chore to constantly update a browser, especially for power users who have a bunch of tabs open at any given time. Google is aware of this and is working on ways to apply fixes silently behind the scenes.
The big feature currently in development is dynamic patching. Because Chrome runs processes separately, dynamic patching can swap out background binaries, such as rendering and GPU tasks, on the fly without shutting down your open tabs or requiring a browser restart.
For heavier security updates that still need a reboot, Google is trying to make the process less intrusive. On macOS, for example, Chrome 150 now quietly reboots itself in the background whenever you close all active windows.
