Google’s Chrome browser is now issuing security patches twice a week.
This frequency marks a sharp departure from the norm. A decade ago, the browser, which pioneered automatic updates, pushed fixes every six weeks. That schedule was once considered controversial. Today, critical software typically receives updates every few weeks. Now, the volume of patches is spiking because AI tools are finding vulnerabilities in software at an unprecedented rate.
The numbers behind the rush
A report released Thursday shows the Chrome security team shipped fixes for 1,072 security bugs in two major version releases during June. That figure exceeds the total number of patches the team delivered across the previous 23 major releases combined. While many of these bugs came from external researchers, the surge is largely driven by the team’s internal process for using AI tools to discover vulnerabilities, sort findings, and write patches.
“In chrome we’ve been using machine learning—using AI before it was called AI—to help find vulnerabilities in particular and automate security fuzz testing work since at least 2012,” Parisa Tabriz, Chrome’s vice president and general manager, told WIRED. “It’s been a huge part of how we find vulnerabilities and empower developers.” She noted that while this approach has long been a staple, the current year feels different. “But I do think this year is very different. It really feels like an inflection point both for offense and defense.”
Chrome is already moving toward a new normal of pushing out a major release every two weeks with additional weekly security updates. However, the intensity of recent vulnerability discoveries has led the group to pilot a cadence of releasing security fixes twice a week.
“The way we ended up here is we had so many vulnerability fixes, so being able to provide two [updates per week] during this time, it made the most sense to us,” says Doug Turner, Chrome’s director of engineering. “Will that last forever? Who knows.”
Why the flood might stop
Turner, like other security researchers, sees evidence that this AI-driven boom may not be permanent. For mature, stable products like Chrome, there appears to be a drop-off in new vulnerability discoveries once the bulk of bugs that can be found with AI have been fixed. This happens partly because AI models can be trained to understand how software projects have evolved over time.
“We’re training our model such that it knows about every security vulnerability that we have seen in the past,” Turner says. “So every CVE, every bug the model knows about. And the second really cool thing is every line of code in Chromium’s history, it knows the reason why that line was changed.”
This context allows AI tools to home in on possible weaknesses across Chrome’s massive and complex codebase, including for features, such as printing, that are no longer under active development and may not attract as many human eyes anymore.
What this means for users
Users can expect more frequent browser updates. The current twice-weekly patching schedule is a direct response to the sheer volume of issues being found. This means the browser will change more often to address security holes before they can be exploited.
Tabriz and Turner emphasise that in addition to patching individual bugs, the Chrome security team is also focused on making structural changes to how the browser is designed. This includes rewriting portions of C++ code in the more secure, memory-safe programming language Rust. The goal is to ensure the software is no longer affected by whole categories of common bugs.
“There’s this near-term spike, but I do think there’s going to be a new equilibrium,” Tabriz says. “Across the industry I think it’s really important that people who are building and thinking about software security are incorporating AI into their development workflows. My highest hope is that everything gets more secure. But I don’t assume everything is going to just get better. I don’t think it’s going to come for free.”
