Chrome fixed 1,072 security bugs in two releases

Google published its numbers on July 30: Chrome 149 and 150, both shipped in June, fixed 1,072 security bugs between them. The previous 23 Chrome releases — two years of updates — fixed 1,036. Two releases beat two years. The bugs were always there. What changed is that an AI agent harness went looking, and your patch process is still calibrated for the rate at which humans used to find things.

What actually happened

Per Google's own Chrome security post, the team built an agent harness in early 2026 that runs Gemini against the Chrome codebase to hunt vulnerabilities — with, they say, higher efficiency and fewer false positives than prior attempts. This isn't a standing start. Chrome Security has been layering this for years: LLM-assisted fuzzing coverage in 2023, Naptime in 2024 giving models specialized vulnerability-research tooling, and Big Sleep with DeepMind and Project Zero in 2025, which turned up real bugs in V8 and the graphics stack.

The detail that should land: one of the finds was a sandbox escape that had been in the codebase for more than 13 years, letting a compromised renderer trick the browser into reading local files. Thirteen years of code review, fuzzing, and a bug bounty program did not surface it. An agent did.

Doug Turner, Chrome's director of engineering, framed it as AI having "fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation." Microsoft reported a parallel spike — a record 570 flaws patched across its product lines in a single month — and also credited AI. Apple has shown no comparable jump.

Why the Chrome security bug surge matters for your business

Read the asymmetry carefully. Google is the defender here and it found these first. But nothing about that harness is proprietary in concept, and the same economics apply to whoever is pointing agents at your stack — your WordPress plugins, your self-hosted GitLab, that Java service nobody has opened since 2021.

Two things break at this volume:

• Triage-by-reading-release-notes is dead. Nobody is evaluating 1,072 CVEs to decide whether this month's update is worth the risk. If your policy is "review the changelog, then schedule a window," that policy now guarantees you run unpatched.
• "It's old and stable, so it's fine" is inverted. A 13-year-old bug in the most-audited browser on earth is the tell. Age was never evidence of safety; it was evidence that nobody had looked hard enough. Now something is looking.

The operator response is boring and it works. Turn on automatic updates for anything with a browser engine in it — Chrome, Edge, Electron apps, embedded webviews. Keep an actual inventory of what you run and what version it's on, because you cannot patch what you can't list. Split your fleet: auto-update everything that isn't load-bearing, and keep one narrow, tested window for the systems that would hurt if they broke. And stop treating a big CVE count as a reason to wait. A release with hundreds of fixes in it is not a scarier release. It's a vendor that finally looked.

Sources: Google Security Blog, TechCrunch, BleepingComputer.