Google patched 1,072 security bugs across Chrome 149 and Chrome 150, exceeding the total fixed across the preceding 23 release milestones, according to BleepingComputer's report on Google's data. Google attributes the increase to expanded use of large language models across vulnerability discovery, triage, patch generation, and testing.
Google patched 1,072 security bugs across Chrome 149 and Chrome 150, more than the total fixed over the previous 23 Chrome release milestones, according to figures reported by BleepingComputer. The increase follows Google's expanded use of large language models throughout Chrome's vulnerability-management workflow.
BleepingComputer reports that Google uses LLMs to discover vulnerabilities, reproduce bug reports, assess severity, route issues to developers, generate candidate patches, and create tests. The reported total supports the original TechCrunch-syndicated description that Google's June fixes exceeded the volume addressed over the preceding two years.
AI-assisted vulnerability research
Google began applying LLMs to security fuzzing in 2023, according to BleepingComputer. It later worked with Project Zero on Naptime, a system that gave AI models specialized vulnerability-research tools, and with Google DeepMind and Project Zero on Big Sleep, an AI-powered discovery agent.
BleepingComputer reports that Big Sleep found vulnerabilities in Chrome's V8 JavaScript engine and graphics components. In early 2026, Google also created a Gemini-powered agent harness to search the broader Chrome codebase while reducing false positives.
One issue found through the system was a Chrome sandbox escape that had remained in the codebase for more than 13 years, BleepingComputer reports. A successful exploit could have allowed a compromised renderer process to escape the sandbox and induce the browser to read local files.
Triage volume and security operations
Google reported a sharp rise in submissions to the Chrome Vulnerability Reward Program, with the volume by March 2026 exceeding all reports received during 2025. BleepingComputer reports that Google changed the program's priorities toward reports that add value beyond what its automated tooling is already finding and processing.
The company is also adding SECURITY.md files that document trust boundaries and threat models, according to BleepingComputer. Such structured security documentation can make security-relevant code paths more legible to both human reviewers and automated systems.
Google described its multi-agent workflows as complementary to established testing methods rather than replacements for fuzzing, BleepingComputer reports. That distinction matters because AI-generated candidate patches and automated severity assessments still require validation before release.
For browser-security teams, the reported volume illustrates a broader operational pattern: AI can increase both vulnerability discovery and the downstream load on reproduction, deduplication, patch review, regression testing, and release engineering. Faster discovery improves coverage, but it also raises the importance of reliable triage pipelines and safeguards against false positives or unsafe automated fixes.
Key Points #
- 1Google reported 1,072 Chrome security fixes in two releases, showing AI-assisted workflows can substantially increase vulnerability throughput.
- 2LLMs now support discovery, reproduction, severity assessment, routing, patch generation, and testing across Google's reported Chrome security process.
- 3Comparable AI-assisted security programs often shift bottlenecks from bug discovery toward triage, validation, regression testing, and coordinated release operations.
Scoring Rationale #
The reported scale of Chrome vulnerability remediation is notable because Chrome is a widely deployed browser and the workflow spans the full security lifecycle. For ML and security practitioners, the story provides a concrete example of LLM agents being integrated with fuzzing, triage, patching, and testing rather than used solely for code generation.
Sources #
Public references used for this report. Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.