Since 2023, Google has released weekly security updates for the Chrome browser, but the company is now testing a twice-per-week cadence to stay ahead of "AI-powered attacks."
A Google white paper released Thursday details its efforts to use large language models to accelerate the discovery of software vulnerabilities. The report includes a graph that shows the number of security bugs fixed in Chrome’s stable releases has skyrocketed in recent months.
“At this point, we have LLMs generating candidate fixes for most vulnerabilities,” the company wrote. “In the last two milestones, Chrome 149 and 150, we have fixed 1,072 security bugs, surpassing the total number of security bugs fixed across the prior 23 milestones combined,” dating back to June 2024.
The problem is that hackers are now using AI models to uncover software vulnerabilities and exploit them quickly. When Google publicly discloses and patches a flaw, details of exploiting the bug are often vague. Still, the very act of publicizing the fix can provide enough hints for an attacker to try to reverse-engineer the issue and “exploit the bug before the fix reaches users’ machines,” the company noted.
“Since fixes committed to the main ‘tree’ typically take weeks to reach the Chrome Stable channel (what the vast majority of our users run), minimizing this patch gap is a critical part of our strategy,” Google added.
As a result, the company says it needs to increase the security fix output. “In the face of fast-moving, AI-powered attacks, our delivery cadence must accelerate even further. To meet this moment, we are piloting a shift to two security releases per week,” the company said, later telling PCMag, "We are piloting it currently."
This comes after the company announced in March that Chrome would "move to a two-week release cycle, from the current four-week cycle,” for stable releases, in an effort to ensure the latest browser enhancements reach users. The two-week cycle for stable releases kicks off in September with Chrome 153.
Although increasing the security release cadence promises to protect users, it also means users need to restart their Chrome browser for the fixes to take full effect. “A restart can be disruptive, requires scheduling in between tasks, and is rarely the top priority at any given moment. To eliminate this friction, we are pioneering ways to shift the burden away from the user," Google says.
One method, called “dynamic patching,” promises to replace background processes with updated binaries “on the fly,” eliminating the need to restart Chrome. Another effort involves finding “opportune moments to restart automatically,” and then offering a session restore to bring back all the tabs. “For example, in Chrome 150, we rolled out a change to take advantage of the unique application state on macOS, where applications typically continue running in the background even after all windows are closed. Now, if Chrome detects a pending update while in this windowless state, it automatically restarts,” the company says.
Google didn't say when dynamic patching will arrive. For now, Google is saying “stay tuned” as it develops the feature. But it noted: “Our long-term vision is a browser that is always up-to-date – continuously and dynamically patched, and automatically restarted during opportune periods of minimal disruption. While we’re working on this, you can keep your Chrome up to date by clicking on the update message in the top right corner.”