Google’s AI-powered vulnerability detection has uncovered a 13-year-old Chrome flaw, highlighting the record-breaking patching pace achieved by the internet giant this year. The discovery, which has left security experts stunned, underscores the growing importance of artificial intelligence in identifying and addressing complex security threats.
The surge in Chrome vulnerabilities began in April and has continued unabated throughout July, with the latest browser release containing a staggering 370 security fixes. This brings the total number of bugs patched this year to over 1,800, surpassing the cumulative total for the previous 23 milestones combined. Google’s use of an AI-powered agent harness, which leverages Gemini to identify security flaws across Chrome’s codebase with increased efficiency, has been instrumental in achieving this record-breaking pace.
One particularly significant discovery made possible by AI is a sandbox escape vulnerability that lurked in the browser for 13 years. Tracked as CVE-2026-3545 (CVSS score of 9.8), this issue could have allowed a malicious actor to trick the browser into reading local files, potentially leading to serious security breaches. The Chrome Security team has long been using Large Language Models (LLMs) since 2023, but it was the agent harness built in early 2026 that has enabled them to find and patch more flaws in the browser.
Google’s AI-powered vulnerability detection is not limited to identifying existing bugs; it also plays a crucial role in preventing new security issues from arising. By analyzing source code strictly at rest on locked-down machines, the AI system can identify potential vulnerabilities as close to code submit-time as possible, reducing the likelihood of memory safety bugs making their way into the browser’s codebase.
To further reduce the patch gap and eliminate memory safety bugs, Google is piloting a twice-a-week Chrome security release cadence. This will complement the existing two-week schedule for major Chrome releases announced in March. The company is also working on automating the generation of release notes and CVE descriptions from security bug fixes to shorten the window between vulnerability discovery and public disclosure.
In addition to these efforts, Google is hardening the runtime environment to squash C++ bugs and transitioning to memory-safe languages like Rust. By expanding MiraclePtr to more libraries and deploying MiracleObject to the GPU main thread, the company aims to neutralize use-after-free defects. Furthermore, it’s taking a ‘spanification’ effort to eliminate out-of-bounds weaknesses and integrating memory allocation protections to block integer overflows.
As Chrome continues to evolve with the latest security patches and features, users can rest assured that their browsing experience is becoming increasingly secure. To stay ahead of potential threats, it’s essential for users to keep their browsers up to date and enable automatic updates whenever possible. By doing so, they’ll be protected from the latest vulnerabilities and enjoy a safer online experience.
Source: SecurityWeek — 2026-07-31