Google's AI Fixed More Chrome Bugs in Two Months Than in the Previous Two Years
Two Chrome releases in June 2026 patched 1,072 security vulnerabilities. The previous 23 Chrome releases, spanning roughly two years back to Chrome 126 in June 2024, fixed 1,036. Google's AI tools outpaced two years of human-assisted security work in a single month.
What Google Did
Chrome 149 and Chrome 150 both shipped in June 2026. Google applied Gemini models to preemptively discover vulnerabilities before release, then used AI tooling to accelerate the patching process. The company published a white paper documenting the approach.
The white paper is notable. Google is not just claiming AI helped -- they are explaining how, which is more useful than a press release with a headline number.
The More Interesting Question
The 1,072 figure raises a question the announcement does not answer: were these bugs always there, or did AI find classes of vulnerabilities that human review consistently misses?
One possibility is that AI-assisted fuzzing and static analysis reaches code paths that manual review skips. If so, the two-year baseline of 1,036 bugs is not a comparison -- it is an artifact of what humans could practically check.
This could mean Chrome's historical bug counts were undercounts, not benchmarks.
Microsoft Is Seeing the Same Pattern
In July 2026, Microsoft patched 570 security flaws in a single Patch Tuesday, a record. Microsoft also attributed the increase to AI-assisted discovery.
Two large companies, two months apart, both reporting record vulnerability counts and both pointing at AI tooling. The pattern is consistent enough to take seriously.
What This Does Not Tell Us
Higher patch counts are not automatically better security. Severity matters more than volume. A thousand low-severity UI bugs fixed does less than one critical RCE caught before shipping. Neither Google nor Microsoft has published severity breakdowns for these AI-assisted batches.
The white paper may address this. Without reading it, the 1,072 number is impressive but incomplete.
The Takeaway
AI is finding more bugs than humans found before, at scale, in production codebases used by billions of people. Whether that means software was always this vulnerable, or AI is finding things humans simply could not, is the more important question. The answer changes how the industry should think about historical CVE counts.
Source: Techcrunch