Summary: Google reported on July 30 that Chrome 149 and 150 closed 1,072 security bugs, more than the preceding 23 milestones combined. Its AI-assisted pipeline includes fuzzing, Project Zero’s Naptime and Big Sleep, and a Gemini-based harness that found a sandbox escape hidden for more than 13 years. Google also automated triage and patching while adding guardrails, faster release cycles, and memory-safety work.
In a July 30 post on its official blog, Google set out how Chrome has fared on security since entering the AI era: versions 149 and 150 closed 1,072 security bugs between them, a total that tops the preceding 23 milestones combined. The other marks in that same post land just as hard. In May, tooling wired into CI caught 20-plus vulnerabilities before they reached a release, one of them rated S1+ critical; by March, reports arriving from outside through the Vulnerability Reward Program had already outstripped all of 2025, which pushed Google to rewrite the program’s rules. To the instinctive worry that bugs are exploding, Google’s answer is plain: finding and fixing more bugs is not a sign of failure.
Two Milestones Outdo the Prior 23: What 1,072 Fixes Actually Say
Reading the figure correctly starts with what it measures — how many issues a team can uncover; code quality is only one variable there. Once discovery moves from people reading code to AI agents, the code covered in a given window changes by orders of magnitude, and repair counts climb in step. Google reads that volume as a sign of health: more defects in the pipeline means flaws silent for years finally occupy a queue someone can drain. The genuine danger was never over-fixing. It was that nobody was looking at all.
Assembled in Layers Over Three Years: Fuzzing Through Big Sleep
The chain took three years to build. AI-assisted fuzzing came first, in 2023. Project Zero added Naptime in 2024, having an LLM work the way a researcher does, looping through attempts to trigger abnormal behavior; its successor Big Sleep, built together with DeepMind, scored its first real-world find that October — an exploitable stack buffer underflow in SQLite, patched the same day and before any release. Across 2025 Big Sleep went on surfacing genuine bugs in V8 and the graphics stack. Early 2026 brought a Gemini-based agent harness scanning the whole Chrome codebase; among its catches was a sandbox escape that had lain undetected for more than 13 years. Defects that are old, deeply buried, and quiet are exactly what ordinary fuzzing reaches least.
Beyond Discovery: AI Writes the Fixes Too
Repair now runs as its own multi-agent arrangement: a patch agent drafts the fix, a critic agent styled after code review works to break it, and further agents author tests — a stack Google says returns weeks of developer time. Farther upstream, automated triage absorbs the filtering, reproduction, metadata enrichment, and routing that once ate 5 to 30-plus minutes of manual work per report, saving hundreds of engineer hours monthly. Those VRP intake numbers only stay workable if triage runs itself: with outside reports past a full prior year by March, the queue has to lean on automation. Once discovery scales, triage and repair become the bottleneck by definition — so Google automated both ends here.
Guardrails, Cadence, and the Memory-Safety Push
Guardrails are explicit: AI reads source only at rest on disk, never while it executes; analysis happens on air-gapped machines; outbound network requests are intercepted and checked against strict allowlists; and subagents may neither modify the system nor leave their designated directories. Cadence adjusts to the load: major milestones now ship on a two-week cycle, security updates stay weekly, and a pilot runs two security releases per week. Dynamic patching — swapping background processes without a restart — remains under research, though Chrome 150 already restarts windowless macOS background processes on its own. Memory safety advances along two tracks: MiraclePtr and MiracleObject keep widening coverage, aimed at up to 90% of use-after-free bugs on the GPU main thread; 97% of first-party code now compiles under strict unsafe-buffer warnings; and modules with the highest defect density have moved to Rust. Dependencies get the same scrutiny: Chrome carries 2,300-plus third-party packages, roughly 1,700 of which ship to users. Google donated $12.5 million to Alpha-Omega and co-founded the Akrites project to carry that discipline upstream.
Four Things Developers Should Carry Away
One: treat “AI found a mountain of bugs” as ordinary operations, not a crisis — fund review and repair, not denial. Two: the hours actually worth reclaiming sit in triage and test automation, not in discovery; the 5 to 30 minutes per report is where cost piles up. Three: dependencies are attack surface — Chrome’s 1,700 shipped third-party packages are a model for reading supply-chain exposure in any large project, and Google’s Alpha-Omega funding plus its Akrites co-founding is worth copying at smaller scale. Four: a two-week milestone cycle with weekly security updates means upgrade testing must run continuously, not as a quarterly chore.