Google Chrome halves update cycle to block AI cyberattacks

Google Chrome is moving to a two-week update cycle for its desktop and mobile versions, halving its previous four-week schedule, in response to the accelerated threat from AI-enabled cyberattacks [1]. This change aims to reduce the "N-day" patch gap, the window between a vulnerability's public disclosure and the delivery of a security fix, which has become critical as large language models (LLMs) enable faster vulnerability discovery and exploit generation [1, 2].

Accelerating Patch Delivery

The shift to a two-week update cycle specifically targets the delivery of security patches to users' browsers [1]. Previously, Google issued major Chrome updates every four weeks, supplemented by emergency security updates as needed [1]. By reducing this delivery time, Google aims to cut the longest side of the "N-day" patch gap from 28 days to 14 days [1]. This strategy is designed to limit the time threat actors have to exploit vulnerabilities once fixes are visible in the public Chromium open-source repository [1]. Google's lead of Chrome browser release, Ben Mason, noted that once a security fix is public, delaying its delivery only prolongs user vulnerability [1].

The company is also exploring ways to dynamically patch Chrome without requiring a browser relaunch, and is piloting a shift to two security releases per week to further accelerate its response to threats [1]. This comes as LLMs are enabling automated vulnerability discovery and exploit generation, with some attacks occurring within minutes or seconds of a zero-day vulnerability's discovery [1, 2].

AI in Vulnerability Detection

Google has been integrating LLMs into its security efforts for years to find and fix bugs faster [2]. In 2023, the Chrome Security team used LLMs to enhance security fuzzing coverage and performance [2]. By 2025, Google collaborated with DeepMind and Project Zero on Big Sleep, an AI vulnerability discovery agent that successfully identified bugs in the V8 JavaScript engine and graphics stack [2]. In early 2026, an agent harness using Gemini found a sandbox escape bug in the Chrome codebase that had existed for over 13 years [2].

Google has since improved its vulnerability-finding agent harness by supporting model interoperability, building a knowledge base of Chrome's CVEs and Git history to extend LLM reasoning, and encouraging developers to add SECURITY.md files to help models understand trust boundaries [2].

What to watch

• Monitor the rollout and user adoption rates of the new two-week update cycle for Chrome.
• Observe any further announcements from Google regarding dynamic patching capabilities or the planned shift to two security releases per week.
• Watch for responses from other major software vendors on how they adapt their patch strategies to counter AI-enabled threats.

The move underscores the escalating "cybersecurity arms race" where defensive strategies must accelerate to match the speed of AI-powered offensive capabilities [1]. The effectiveness of this shortened cycle will depend on how quickly users apply updates and how rapidly Google can implement its next-stage patching innovations.