"Every bug found and fixed is one less foothold for an attacker," Google's Chrome Security Team said.
Chrome 149–151: 1,442 flaws in three releases
Google disclosed that Chrome versions 149 and 150 together contained 1,072 security bugs — a tally the company said surpassed the total fixed across the prior 23 milestones combined. In the follow-up Chrome 151 patch, released Wednesday, Google resolved another 370 flaws (349 of which were reported internally), bringing the three-release total to 1,442 fixes. Seven of the vulnerabilities in the latest patch were marked critical in severity.
CVE-2026-3545: a 13‑year blind spot found with Gemini
Among the defects Google named was a critical sandbox escape in the Navigation component, tracked as CVE-2026-3545 and assigned a CVSS score of 9.6. The vulnerability could be exploited to trick the browser into reading local files from a user’s system and was patched earlier in March. Google said the shortcoming was discovered via an agent harness that leveraged its Gemini models and had remained in the source code for more than 13 years.
AI-driven surge in vulnerability discovery
Google tied the spike in bug discovery to the advent of large language models (LLMs), saying they have accelerated the rate at which new issues are flagged. The company cited statistics from the U.S. National Vulnerabilities Database (NVD) showing 46,872 flaws recorded so far in 2026, a figure nearing the 49,920 vulnerabilities reported for the entirety of 2025. Google warned this pace has produced a situation where issues are being reported "at a faster rate than companies can fix them," and described the environment as one of "fast-moving, AI-powered attacks."
Google's technical response: cadence, dynamic patching, and language shifts
To meet the rising tempo of reports, Google said it is transitioning Chrome to a two-week release cadence for major milestones alongside weekly security updates, and is piloting a move to two security releases per week. The company is also prototyping dynamic patching to avoid or reduce restarts: by "leveraging Chrome's multi-process architecture, dynamic patching sequentially replaces background child processes (like the Renderer and GPU) with updated binaries on the fly," Google explained.
Google offered a concrete example from Chrome 150 on macOS: by taking advantage of an application state in which macOS utilities often continue running after all windows close, Chrome can automatically restart when it detects a pending update while in that windowless state, reducing user disruption. The company is also automating parts of the disclosure pipeline, working to generate release notes and CVE descriptions from security fixes to shorten the window between discovery and public disclosure.
Engineering changes to eliminate whole classes of bugs
Beyond cadence and patch mechanics, Google described efforts to reduce the root causes of memory- and logic-related flaws. The company said it is hardening Chrome's runtime environment against legacy C++ weaknesses, transitioning components to memory-safe languages such as Rust, and implementing the browser's top-level user interface using HTML, CSS, and TypeScript to reduce reliance on traditional C++ frameworks. In addition, Google plans to move all Chrome third-party dependencies onto automated update pipelines to keep those components current.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: expect a faster stream of disclosed fixes and more frequent security releases; teams will need to adapt patch testing and deployment workflows to match Google's two-week cadence and potential twice-weekly security updates, and to evaluate dynamic-patching behavior described for child processes like Renderer and GPU.
- Procurement and enterprise IT leaders: automated release notes and CVE descriptions may shorten the time between discovery and actionable information, but the pace of reported issues — the NVD count of 46,872 so far in 2026 — suggests update automation and dependency pipelines will remain operational priorities.
- End users and general public: Google is pursuing measures to reduce restart interruptions (for example, the macOS windowless-state automatic restart introduced in Chrome 150) and to apply patches without manual action, but the company emphasized that shipping and applying fixes faster than adversaries can exploit them remains an ongoing challenge.
"Even with this pace, proper public disclosure remains paramount," Google wrote, underlining that every security bug that reaches Chrome Stable is documented and disclosed publicly as a standard best practice. The sheer numbers — 1,442 fixes across three recent releases and tens of thousands of NVD-reported flaws in 2026 — frame a blunt question for Chrome and the broader software ecosystem: can faster release cadences, dynamic patching, and language-level changes outpace an AI-accelerated surge in vulnerability discovery?
Source: https://thehackernews.com/2026/07/three-recent-chrome-releases-fix-1442.html
