Modern web browsers receive security updates so frequently that most users rarely notice them.
A new version appears, a restart is requested, and the cycle repeats. Behind those routine updates, however, browser vendors are dealing with software that has grown into one of the most complex consumer applications in use today, with millions of lines of code, support for countless web standards, and an expanding attack surface that is constantly scrutinized by both security researchers and malicious actors.
AI is beginning to reshape that process.
Rather than replacing human security engineers, AI is increasingly being used to review enormous codebases, identify suspicious patterns, validate potential vulnerabilities, and even suggest patches.
The result is not necessarily fewer bugs being created, but a much faster ability to find and fix them before attackers can exploit them.
Google says this shift became especially apparent in June.
According to the company's blog post, Chrome versions 149 and 150 fixed a combined 1,072 security vulnerabilities.
That is more than the 1,036 security bugs patched across the previous 23 Chrome releases spanning roughly the last two years. Google attributes much of that increase to improvements in its AI-assisted security workflow, which now plays a larger role in vulnerability discovery, triage, validation, and code repair.
The figures may seem surprising at first glance, but Google argues they do not necessarily indicate that Chrome suddenly became less secure.
Instead, they reflect a dramatic increase in the company's ability to uncover existing weaknesses that had previously remained hidden.
Large language models (LLMs) trained on historical vulnerabilities, code changes, and previous fixes can examine legacy components at a scale that would be difficult for human reviewers alone.
Some of those components are no longer actively developed but still remain part of the browser's codebase.
Google's security team describes AI as changing the economics of vulnerability research.
Finding software flaws has traditionally required significant manual effort, limiting how many areas engineers could inspect. From manual finding to bug hunting, the process can be lengthy.
AI systems automate much of the repetitive analysis.
This allows security teams to investigate substantially more code while human experts focus on verifying findings, assessing risk, and reviewing proposed fixes. According to the company, AI-generated candidate patches are now produced for most vulnerabilities before engineers finalize and approve them.
The increased pace of bug discovery has also forced Google to rethink how quickly Chrome receives security updates.
The company is piloting a twice-weekly security release schedule to reduce the time between identifying a vulnerability and delivering a fix to users.
Shortening that window is important because once a security patch becomes public, attackers often study it to understand the underlying flaw and target users who have not yet updated their browsers.
Google is also working to reduce the disruption caused by more frequent updates.
Alongside its accelerated patching efforts, the company is developing dynamic patching technologies that could eventually allow Chrome to apply certain security fixes without requiring a full browser restart.
Early implementations already allow automatic restarts in limited situations, such as when Chrome is running in the background without open windows on macOS.
Even with AI accelerating bug discovery, Google does not expect software security to become an automated problem that machines simply solve on their own.
Company engineers note that structural improvements remain essential.
Chrome continues its long-term effort to replace older C++ components with memory-safe languages such as Rust, which can eliminate entire categories of vulnerabilities rather than repeatedly patching individual bugs after they are found.
The broader cybersecurity industry is experiencing similar changes.
AI is making vulnerability research faster for defenders, but it is also lowering the barrier for attackers searching for exploitable weaknesses. Security researchers increasingly describe the field as an AI-driven arms race in which both sides can analyze software at unprecedented speed.
That makes rapid detection, validation, and patch deployment increasingly important as the time between discovering a flaw and attempting to exploit it continues to shrink.
For Chrome users, the most visible result is likely to be a growing number of updates arriving throughout the month. While frequent patching can sometimes feel inconvenient, Google argues it reflects a browser that is being examined more aggressively than ever before.
In that sense, the sharp rise in security fixes is less a sign of declining software quality than of increasingly capable tools uncovering problems that had been waiting in the code for years.
