Google Patches Record 1,072 Chrome Bugs in June, AI-Powered Fixes Surpass Two-Year Total

Google's Chrome browser just had its most productive security month on record. In June 2026, the company patched 1,072 vulnerabilities across two browser versions, Chrome 149 and 150. That single month's tally surpasses the 1,036 bugs fixed in the previous 23 versions released over the prior two years combined.

The unprecedented surge is not a coincidence. Google credits its internal AI tools, specifically large language models (LLMs) like Gemini, for transforming vulnerability discovery from a manual, expert-driven process into an automated, industrial-scale operation. The company published a white paper detailing how these models now handle everything from finding bugs to generating fixes.

How AI Is Automating the Bug Lifecycle

Google's AI-powered security pipeline covers the entire lifecycle of a vulnerability: discovery, triage, fixing, and release. The company has been using LLMs for years, but the current scale is unprecedented. In early 2026, Google built an agent harness using Gemini that found vulnerabilities across the broader Chrome codebase with higher efficiency and lower false positives.

One notable find was a sandbox escape bug that had quietly survived in the codebase for more than 13 years. This bug would have allowed a compromised renderer to trick the browser into reading local files. For many on the Chrome security team, this moment cemented the potential of AI-powered vulnerability detection.

The system now includes a multi-agent workflow. A fixing agent generates multiple candidate fixes, a critic agent evaluates which is best, and test-writing agents ensure tests work across all supported platforms before a human developer reviews the fix. This saves up to weeks of developer time per bug.

Triaging at Scale

As AI tools discovered more vulnerabilities, Google simultaneously scaled its triage process. Historically, triaging a single security report took 5 to 30 minutes and relied primarily on human expertise. The new automated system blends rule-based systems with AI to increase throughput and accuracy.

The triage process now includes four key phases: filtering out noise, reproducing bugs, enriching reports with metadata, and automatic assigning. Google estimates this new process is saving hundreds of hours of developer time per month, allowing the team to focus on other security priorities.

Industry-Wide Trend

Google is not alone in this shift. Microsoft also reported a record number of patches in June, driven by AI tools. This trend reflects a broader industry realization that AI-powered systems will find an increasingly exponential number of bugs, forcing defenders to also use AI to get ahead of malicious hackers.

Doug Turner, Chrome's director of engineering, told TechCrunch that LLMs have "fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation." He added that by applying models like Gemini, Google is "preemptively fixing vulnerabilities, outpacing our adversaries and making Chrome safer with every update."

Patch Gap and Delivery Cadence

Finding and fixing bugs is only half the battle. Google is also working to minimize the "patch gap" — the time between a fix landing in the public source code and reaching users' machines. Since fixes committed to the main tree typically take weeks to reach the Chrome Stable channel, attackers can reverse engineer and exploit bugs during this window.

Google is transitioning to a two-week cadence for major Chrome milestones, with weekly security updates. However, the company is now piloting a shift to two security releases per week to match the pace of AI-powered attacks. The company is also investing in "dynamic patching" to eliminate the need for a full browser restart in most cases.

Memory Safety and Long-Term Strategy

Beyond fixing individual bugs, Google is investing in eliminating entire classes of vulnerabilities. Chrome's two-layered memory safety strategy includes hardening the runtime environment for legacy C++ code while shifting to memory-safe languages like Rust for long-term architectural resilience.

The company is expanding its MiraclePtr and MiracleObject technologies to neutralize use-after-free vulnerabilities, and is pushing a massive "spanification" effort to eliminate out-of-bounds spatial safety errors. Currently, 97% of first-party Chrome code compiles cleanly with strict unsafe-buffer warnings.

For the long term, Google is building a centralized Rust SDK to make Rust a routine engineering choice for new components. The company is also exploring implementing the browser's top-level user interface using HTML, CSS, and TypeScript to further reduce dependencies on traditional C++ frameworks.

What This Means for Users and Investors

For users, the surge in bug fixes means Chrome is getting more secure, faster. Every bug found and fixed is one less foothold for an attacker. Google's ability to fix more bugs in a single month than it used to fix in two years reduces the risk of a major breach that could damage user trust or cause costly outages.

For investors, the question is which companies are turning AI-powered security into a real competitive advantage. Google's efficiency gains from AI investments could show up in lower costs and fewer emergency patches down the road. The ability to stay ahead of attackers is a quiet but real competitive edge in the browser market.

As the AI era intensifies the software security threat landscape, Google is betting that by combining rapid deployment mechanisms with deep structural defenses, the advantage will remain firmly with defenders. With this approach, Chrome and the broader web become safer with every update.