AIBRIEF
Google's Chrome team is shipping security fixes twice a week after AI driven tools uncovered 1,072 bugs in two releases — more than the previous 23 combined.
Google's Chrome team fixed 1,072 security bugs across its June 2026 browser milestones — more than the previous 23 combined — and is now piloting a twice-weekly security-fix release cadence to keep up with what its own AI pipeline is finding. Chrome VP and general manager Parisa Tabriz called 2026 "an inflection point both for offense and defense" in a WIRED interview tied to the Chrome Security Team's own post.
The mechanism runs four ways. A Gemini-based finding harness and Project Zero's Big Sleep agent scan every code change. A four-phase triage system — filtering, reproducing, enriching, and routing — sorts reports automatically. A multi-agent fix loop (fixer, critic, test writer) runs in continuous integration every 24 hours. In May, the system blocked more than 20 vulnerabilities from production, including a critical severity-1 issue and a sandbox-escape bug that had lived in the codebase for 13 years.
The new cadence runs alongside Chrome's existing two-week major release and weekly security update. Chrome Security's Doug Turner called it a pilot: "Will that last forever? Who knows." Tabriz described the workload shift as a near-term spike that should resolve to a new equilibrium, paired with structural hardening, including rewriting portions of C++ in memory-safe Rust.
External intake has already crossed that line: by March 2026, third-party researchers were filing more reports per month than in all of 2025. Defense is catching up to offense, and Chrome is shipping accordingly.