On July 31, 2026, Beijing time, the Chrome security team announced that it uses large-scale language models throughout the vulnerability discovery, classification, candidate fix, and release processes. In the two most recent milestone releases, Chrome 149 and 150, a combined 1,072 security issues were fixed, a number that exceeds the previous 23 milestones combined. The official announcement does not claim that all these issues were automatically discovered or fixed by AI. Google did not elaborate on the specific distribution of these 1,072 issues, their severity, or whether they are being exploited in the wild.
From fuzz testing to proxy scanning
The Chrome security team worked with Google DeepMind and Project Zero to build a Gemini-based agent framework in early 2026 for analyzing the entire Chrome codebase. The tool discovered a sandbox escape issue that was more than 13 years old, which Google said could allow a compromised renderer to trick the browser into reading local files. The team has gradually used large language models to expand security fuzz testing coverage since 2023, developed Naptime in 2024, and promoted Big Sleep in 2025; these timelines and effect descriptions are all from Google.
The agent framework supports open weight models and proprietary models, and uses a knowledge base containing previous Chrome CVEs and the entire Git history. It reads the trust boundary description in the SECURITY.md file, sets up an independent criticism agent to evaluate the findings, and repeatedly runs the model against the code base to handle non-determinism in the model output. The official did not disclose the division of labor, false positive rate, reproduction rate and manual rejection ratio of each model, nor did it provide external audit results. Therefore, these designs cannot be directly converted into independently confirmed vulnerability discovery capabilities.
Constrained environments and automatic classification
The Chrome security team stated that the model only analyzes static source code on locked machines, which do not have general Internet access capabilities; the dedicated scanning environment intercepts all network requests and implements a strict whitelist based on the originating application and destination address. Google also said that the model will not run in unrestricted mode, and the subagent cannot modify the local system or access files outside the specified source code directory. The above control measures and boundaries are self-reported by Google. The announcement does not disclose external testing, audit scope or control failure records.
The automatic classification process is divided into four stages: first filtering spam and duplicates, then checking the proof of concept and replicating it on the affected operating system and browser version, then adding information such as stack, introduction time and severity, and finally assigning the report to the corresponding component and human responsible person. Google said that in the past, manual processing of a single security report usually took more than 5 to 30 minutes. The new process can save hundreds of hours of development time every month; developers can still modify the automatically given severity ratings, and there is no external verification of these efficiency figures.
Candidate fixes still require manual review
In the candidate fix stage, the agent first returns multiple candidate patches, which are then evaluated by the criticism agent with independent context. The two simulate code review in a loop; the test agent writes tests for the candidate solutions and covers the platforms and configurations supported by Chrome, and is then reviewed and fixed by the developers. The Chrome security team stated that most vulnerabilities have been candidate fixes generated by large language models, but the official process still divides candidate generation, critical evaluation, automatic testing, manual review and official release into different steps, and cannot be written to allow AI to autonomously send patches into the production environment.
Big Sleep and CodeMender have been integrated into Chrome's continuous integration system. Google said that both tools scan the entire change list every 24 hours to identify issues near the code submission stage. The company also said that in May 2026 alone, this integration prevented more than 20 vulnerabilities from entering production, including one critical issue designated as S1+. The official has not disclosed the complete list of this batch of problems, duplication, false positive rate, manual review results or independent verification materials, so these numbers can only be used as internal statistics of the Chrome security team.
Shorten patch delivery gap
Google refers to the time between fixes in the public source code reaching the stable version as the N-day patch gap, because attackers may reverse engineer the patch before users can obtain the update. Chrome is moving to a bi-weekly major release rhythm, with the current security update frequency being once a week and experimenting with twice-weekly security releases. The team is also working on dynamic patches so that the background renderer and GPU processes can be replaced one after another without completely restarting the browser; Chrome 150 can already restart automatically when macOS does not open a window and there are updates to be installed.
Editorial analysis: After automating the expansion of vulnerability discovery, verification, candidate fix quality, public disclosure, stable version release and client update delivery have become continuous constraints in the same security chain. The 1,072 statistics published by Google are security issues fixed in Chrome 149 and 150, and cannot be equated to the number of independently verified AI discoveries, total CVEs, zero-day vulnerabilities, or wild exploits. The existing official materials do not provide severity distribution, duplication number, manual rejection rate, actual attack data and external audit conclusions. The number of fixes alone cannot compare the security level of Chrome with other browsers.