Chrome’s security update rhythm is changing because the way bugs are found is changing. AI tools are helping the Chrome security team discover, triage, and fix vulnerabilities at a pace that has temporarily pushed the browser toward twice-weekly security patches.
The shift is not only about Chrome. It points to a broader software security question: what happens when defenders can find far more flaws, far faster, than traditional release cycles were built to handle?
Chrome’s patch volume has surged
Chrome has long treated fast security updates as a central feature. A decade ago, it was controversial that the browser, the first to add automatic updates, shipped patches every six weeks. Today, critical and widely used software often receives security fixes every few weeks.
Now the pace is increasing again. In a report published Thursday, the Chrome security team said the browser’s two major version releases in June included fixes for 1,072 security bugs. That was more than the team shipped in the prior 23 big releases combined.
Many of those bugs came from researcher submissions. But the source article says the larger spike has been driven by Chrome’s internal use of AI tools across vulnerability discovery, triage, and patch development.
AI is changing how bugs are found
Chrome’s security team has not started from scratch with AI. Parisa Tabriz, Chrome’s vice president and general manager, told WIRED that Chrome has used machine learning, described as AI before it was called AI, to help find vulnerabilities and automate security fuzz testing work since at least 2012.
What is different now is scale and speed. Tabriz described this year as a turning point for both attack and defense. In practical terms, AI vulnerability hunting is creating a larger flow of issues that need to be reviewed, prioritized, fixed, and shipped to users.
Chrome is already moving toward a new normal of major releases every two weeks, with additional weekly security updates. For now, the team is piloting security fixes twice a week because the number of vulnerability fixes has been so high.
Doug Turner, Chrome's director of engineering, said the decision came from having so many fixes ready that two updates per week made sense during this period. He also left open whether that cadence will continue indefinitely.
The spike may not last forever
The current flood of AI-discovered vulnerabilities may be temporary, at least for mature and stable products like Chrome. Turner said there appears to be a point where the number of new vulnerabilities drops after the bulk of AI-findable bugs has been fixed.
One reason is that AI models can be trained with a deep view of a software project’s history. Turner said Chrome is training its model to know about every security vulnerability the team has seen in the past, including every CVE and every bug. He also said the model knows every line of code in Chromium's history and the reason that line changed.
That context matters because Chrome is a large and complex codebase. AI tools can use historical knowledge to look for possible weaknesses across many areas, including features that are no longer under active development. The source article gives printing as one example of a feature that may not receive as many human eyes anymore.
This is a different kind of security review from waiting for a single researcher to notice a problem in one part of the browser. It allows the system to search across old and new code with memory of past vulnerabilities and past fixes.
Patching is only part of the answer
Fast patching matters, but the Chrome security team is also focused on structural changes. Tabriz and Turner emphasized that the goal is not only to keep fixing individual bugs as they appear.
One example in the source article is rewriting portions of C++ code in Rust, described as a more secure, “memory safe” programming language. The broader aim is to change how the browser is designed so whole categories of common bugs no longer affect the software.
That distinction is important. Twice-weekly updates can help manage a short-term surge, but design changes may reduce the number of problems that need to be patched later. The source article frames this as a move from constant whack-a-mole patching toward removing recurring classes of security issues.
A new security balance is still forming
The Chrome team appears to see the current period as both productive and unstable. AI is helping defenders find more vulnerabilities, but that also means more work for the people and systems responsible for turning discoveries into reliable security fixes.
Tabriz said there is a near-term spike, but she expects a new equilibrium. She also said people building and thinking about software security should be incorporating AI into their development workflows.
The key point is that better security will not happen automatically. AI bug hunting can expose more problems, and it can help teams move faster, but the source article makes clear that the benefit depends on how those tools are built into development, triage, patching, and longer-term engineering choices.
For Chrome, that has produced an unusually rapid security update experiment. For the wider software industry, it is an early look at what security maintenance may look like when AI systems can search old code, remember old bugs, and keep finding new work for defenders to do.