Google fixes 1,072 Chrome bugs in June, outpacing two‑year total

Google’s Chrome team patched 1,072 security bugs in the two major releases rolled out in June, eclipsing the total number of fixes across the previous 23 major releases combined [2]. The surge underscores an AI‑powered shift in vulnerability discovery and forces Google to accelerate its release cadence, with implications for users and rivals alike.

AI‑driven discovery fuels the spike

Google’s security team attributes the unprecedented volume of fixes to its expanding use of machine‑learning tools that automate fuzz testing and triage [2]. Parisa Tabriz, Chrome’s VP, notes that while AI‑based hunting has been part of the workflow since 2012, “this year is very different” as the models now scan the entire Chromium codebase and historic CVE data [2]. The result is a rapid identification of high‑impact flaws, including ten use‑after‑free vulnerabilities classified as critical in the Chrome 149 update [1].

Operational changes and user impact

To cope with the influx, Google is moving to a two‑week major‑release schedule starting in September, with additional weekly security patches [3]. It is also piloting “dynamic patching” that would apply fixes without forcing a browser restart, aiming to reduce exposure to “N‑day” attacks that exploit unpatched systems [3]. Users can manually update to Chrome 149, which addresses critical bugs such as CVE‑2026‑13028, CVE‑2026‑13038 (Autofill), and a high‑impact Bluetooth use‑after‑free issue [1].

Competitive landscape

Chrome’s aggressive patch cadence puts pressure on other browsers that still rely on six‑week update cycles. While competitors have begun experimenting with AI‑assisted security testing, none have publicly disclosed a comparable volume of fixes. The shift may force the broader browser market to adopt more frequent release rhythms or risk falling behind Chrome’s security baseline.

What to watch

• Release cadence: Google’s rollout of bi‑weekly major versions and twice‑weekly security updates beginning September [3].
• Dynamic patching rollout: Adoption of restart‑free updates in Chrome 150 on macOS and potential expansion to other platforms [3].
• AI model evolution: Updates to Google’s internal vulnerability models that could further accelerate bug discovery or reach a “new equilibrium” as the low‑hanging fruit are exhausted [2].

The June patch surge illustrates how AI can transform software security, but it also raises questions about the sustainability of such high‑velocity fixing and whether the industry can keep pace without compromising stability.