AI-Driven Vulnerability Detection in Chrome
Google has confirmed that the surge in Chrome vulnerabilities this year has been driven by the use of AI-powered vulnerability detection. The increase in Chrome bugs started in April and has continued throughout July, with the latest browser release containing 370 security fixes.
The total number of bugs patched this year has surpassed 1,800, with 1,072 security defects patched in the Chrome 149 and 150 releases. This is a significant increase, driven by the use of an agent harness that leverages Gemini to identify security flaws across Chrome's codebase with increased efficiency.
13-Year-Old Sandbox Escape Flaw Discovered
The AI-powered vulnerability detection was validated by the discovery of a sandbox escape flaw that had lurked in the browser for 13 years. Tracked as CVE-2026-3545, the issue could have allowed a compromised renderer to trick the browser into reading local files.
The vulnerability, described as an insufficient data validation in Navigation, could have been exploited via crafted HTML pages to perform a sandbox escape. It was patched in early May in Chrome 145.
AI-Powered Vulnerability Detection Process
Google's Chrome Security team started using Large Language Models (LLMs) in 2023, but it was the agent harness built in early 2026 that has been essential to finding and patching more flaws in the browser. The agent harness has support for model interoperability, was trained on a knowledge base of previously identified CVEs and of Chrome's entire Git history, and leverages developer-supplied SECURITY.md files.
The AI analyzes source code strictly at rest, operating on locked-down machines that lack general internet access. While also relying on AI for bug validation, triaging, and patch generation, Google continues to use other security testing infrastructure for bug detection and welcomes researchers submitting vulnerability reports through its Vulnerability Rewards Program (VRP).
Reducing the Patch Gap and Eliminating Memory Safety Bugs
To reduce the patch gap, Google is piloting a twice-a-week Chrome security release cadence, which will complement the two-week schedule for major Chrome releases announced in March. The company is also working on automating the generation of release notes and CVE descriptions from security bug fixes to eliminate manual bottlenecks and shorten the window between vulnerability discovery and public disclosure.
Google is also working on ensuring that Chrome is always up to date on users' machines, through dynamic patching, seamless session restoration, and restarts while in a windowless state. Additionally, the company is working on eliminating entire classes of security issues from Chrome, such as memory safety flaws, by hardening the runtime environment to squash C++ bugs and transitioning to memory-safe languages like Rust.
Long-Term Plans for Chrome Security
In the long term, Google is transitioning Chrome's codebase to memory-safe languages like Rust, through building a centralized Rust SDK, deploying Rust to replace most flawed code segments, and writing new modular components in Rust. The company is also exploring options like implementing the browser's top-level user interface using HTML, CSS, and TypeScript to further reduce dependencies on traditional C++ frameworks.
According to Google, keeping the open-source software ecosystem secure is another critical aspect of improving Chrome users' protections. The company has been using automated vulnerability scanning pipelines to keep dependencies patched and will move all Chrome third-party dependencies onto automated update pipelines.
Every bug found and fixed is one less foothold for an attacker. But discovering and fixing a bug is only half the battle — we must also ship the fix and apply the update for users faster than adversaries can exploit the bug, and invest in projects that mitigate or eliminate classes of bugs through accelerated release cadences, dynamic patching, and opportune restarts, we are driving toward a browser that is continuously protected without disrupting the user.
Google's efforts to improve Chrome security are ongoing, with a focus on using AI-powered vulnerability detection, reducing the patch gap, and eliminating memory safety bugs. The company's long-term plans for Chrome security include transitioning to memory-safe languages like Rust and exploring new options for implementing the browser's user interface.
Source: SecurityWeek