Last updated: August 1, 2026 · By Vishal Swami, Founder & Lead AI Reviewer, AISagely
Google fixed more Chrome bugs in June than over the past two years, thanks to AI. Chrome 149 and 150, both shipped in June 2026, patched 1,072 security vulnerabilities between them, per Google’s own count — more than the 1,036 bugs fixed across the previous 23 releases combined going back to 2024. Google credits its AI vulnerability-hunting tools, including Big Sleep and an internal Gemini-based scanning harness, for the jump.
Short answer: According to Google, Chrome 149 and 150 fixed 1,072 security bugs in June 2026 alone, beating the 1,036 bugs patched across the prior 23 releases over two years. Google says AI tools like Big Sleep and Gemini found most of them before attackers could, including a 13-year-old sandbox escape flaw (CVE-2026-3545). Chrome director Doug Turner called it a shift in "the economics of cybersecurity."
I track how AI tools perform on real tasks for a living. That includes checking how they hold up against claims vendors make about their own products. A security team publicly crediting AI for a three-times jump in bug discovery is exactly the kind of claim I wanted to check against primary sources, not just the headline. In my testing of AI coding and reasoning tools over the past year, this pattern tracks with what I've seen elsewhere. AI is genuinely good at pattern-matching across huge codebases for known bug classes. Chrome's numbers back that up with specifics Google didn't have to share.
What's actually behind the number
Google's Chrome Security Team published the numbers in a July 30, 2026 post on the Google Security Blog. TechCrunch got Chrome's director of engineering, Doug Turner, on the record the same day. The tools doing the work aren't a single product. They're a stack Google has been building since 2023: Naptime, built with Project Zero, and its successor Big Sleep. Both are designed to have an LLM read source code the way a human security researcher would. A newer Gemini-based harness, deployed in early 2026, scans the Chrome codebase on an ongoing basis instead of waiting for a researcher to point it at one file.
The most striking single find is CVE-2026-3545, a critical sandbox escape in Chrome's navigation component, rated 9.6 on the CVSS scale. Google says the bug had been sitting in the codebase for more than 13 years before Big Sleep flagged it in March 2026. That's long enough to predate most of the engineers now working on Chrome. By March, Turner said, Google's security team "received more bug reports than we had in the entirety of 2025." Chrome 151, released the week after the June numbers, added another 370 fixes. Internal tooling surfaced 349 of them. Turner's framing is blunt: AI has "fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation." Chrome VP Parisa Tabriz was more measured. She told reporters: "There's this near-term spike, but I do think there's going to be a new equilibrium." That's a fair caveat, since part of this surge is Google clearing out old debt, not a permanently higher bug rate.
What you need to understand this shift
You don't need a security background to follow what changed here. Three concepts do the heavy lifting. First, a fuzzer is a tool that throws malformed or random input at software to see what breaks it. That's the old-school way of finding bugs, and it's still part of Chrome's pipeline. Second, an LLM-based bug hunter like Big Sleep reads code the way a person does. It reasons about what a function is supposed to do and where its logic could fail, which catches bugs fuzzers miss. Third, CVSS is the 0–10 severity scale security teams use to triage. Anything above 9.0, like CVE-2026-3545's 9.6, counts as critical. None of this requires you to run any tool yourself; Chrome auto-updates. But it explains why "AI found more bugs" is a different claim than "AI writes safer code."
What the June surge means for your own Chrome use
1. Confirm you're on Chrome 151 or later
Open chrome://settings/help and let it auto-update if it isn't current. The fixes described here only protect you once the patched version has actually installed, and Chrome sometimes needs a full browser restart to apply an update it already downloaded.
2. Don't assume "more bugs found" means "less safe browser"
A rising CVE count from a vendor that's actively hunting for its own flaws is a different signal than a rising count from outside researchers finding what a vendor missed. Google finding and fixing its own 13-year-old bug before it was exploited is the system working, not failing.
3. Watch whether other browsers keep pace
Microsoft reported patching 570 flaws in its June Patch Tuesday cycle, also crediting internal AI tooling. That's comparable acceleration to Chrome. Apple, by contrast, patched 482 bugs so far this year, roughly in line with last year's pace, with no comparable AI-driven spike reported. If you're choosing a browser partly on security grounds, that gap is worth knowing about.
4. Treat this as a preview of AI's near-term security role
The realistic read, based on Tabriz's "new equilibrium" comment, is that this is a one-time catch-up surge as AI tools clear a backlog of old bugs, not a permanent 3x baseline. Expect the numbers to normalize over the next few release cycles even as the tools stay in place.
5. Apply the same skepticism to AI security claims that you'd apply to any vendor stat
I checked Google's blog post and TechCrunch's reporting against each other before writing this, and the core numbers matched. That's a useful habit for any AI-related stat a company puts out, security or otherwise — cross-check the primary source before repeating a headline.
Example prompts you can copy
If you want an AI assistant to help you make sense of a security disclosure like this one, these prompts work well with Gemini, Claude, or ChatGPT.
- Translate a CVE into plain English: "Explain CVE-2026-3545 in Chrome in plain English: what it is, how severe a 9.6 CVSS score actually is, and whether I need to do anything as a regular user."
- Check your own exposure: "I'm running Chrome on [Windows/Mac/Linux]. Walk me through checking my exact version number and confirming whether it includes the June 2026 security fixes."
- Sanity-check a vendor security claim: "Here's a company's blog post claiming AI helped them fix three times more security bugs than usual: [paste text]. What specific numbers back that up, and what's missing that I'd want to see before trusting the claim?"
- Compare browser security posture: "Compare how Chrome, Edge, and Safari have handled security patching this year based on published bug-fix counts. Which vendor is disclosing the most detail?"
Common mistakes to avoid
The mistake I see most often, per Google's own framing, is reading "1,072 bugs fixed" as "Chrome had 1,072 new security holes in June." It didn't. Most were old bugs that AI tools surfaced and engineers then fixed before anyone could exploit them. A higher fix count from a vendor hunting its own flaws is a good sign, not a bad one.
Second is assuming every browser saw the same AI-driven jump. Apple's bug count stayed flat this year, per BigGo Finance's reporting, at 482 patches — roughly its normal pace. Don't apply Chrome's numbers to browsers that haven't reported anything comparable.
Third is ignoring Parisa Tabriz's own caveat. According to Tabriz, this is a "near-term spike" likely to settle into a "new equilibrium." Treat the 1,072 figure as a one-time catch-up number, not Chrome's new monthly normal.
Fourth, and the one I care about most, is repeating a vendor's self-reported stat without checking it. I cross-checked Google's blog post against TechCrunch's reporting before using either number here. Do the same with any AI performance claim you read.
June 2026 vs. the prior two years: Chrome bug fixes by the numbers
| Metric | Chrome 149 + 150 (June 2026) | Prior 23 releases (2024–2026) |
|---|---|---|
| Total security bugs fixed (per Google) | 1,072 | 1,036 |
| Notable critical find | CVE-2026-3545, CVSS 9.6, 13+ years old | — |
| Primary detection method | Big Sleep + Gemini harness (AI) | Traditional fuzzing + human research |
| Next release (Chrome 151) | 370 more fixes, 349 AI-flagged | — |
| Comparable industry move (per BigGo Finance) | Microsoft: 570 flaws, June Patch Tuesday, AI-credited | Apple: 482 bugs, pace unchanged year over year |
Figures per Google's July 30, 2026 security blog post and BigGo Finance's reporting the same week.
Tools that make sense of AI security claims
If this story has you curious about what these AI models can actually do outside of Google's internal security stack, my Gemini guide covers the same family of models Google used to build its Chrome-scanning harness. For a broader look at where AI reasoning genuinely holds up under scrutiny, versus where it's overhyped, start with why AI reasoning is sometimes right for the wrong reasons. My AI tool ratings hub tracks claims like this across vendors, rather than taking any single blog post at face value. If cybersecurity-specific AI capability is what you're after, the UK AI Security Institute’s assessment of Kimi K3’s cyber capabilities is the closest thing to an independent audit of this exact question: how good AI models actually are at finding and understanding vulnerabilities. It's worth reading alongside Google's own numbers. And if you're weighing whether AI's productivity gains are real across a workflow, rather than just in a headline stat, my look at the AI productivity illusion is the right next read.
My take
This is one of the more credible AI-security claims I've checked this year. Google backed it with a specific, verifiable bug (CVE-2026-3545) instead of a vague "AI made us more secure" line. A competing vendor's numbers (Microsoft's 570) and a non-AI baseline (Apple's flat 482) both showed up in the same reporting cycle for comparison. The honest caveat is Tabriz's own: this is a catch-up spike, not a new monthly rate, and Google has every incentive to frame a one-time backlog clearance as an ongoing trend. For everyday Chrome users, the practical takeaway is small: keep auto-update on and you're covered. For anyone building or reviewing AI tools for a living, this is a rare case of an AI capability claim specific enough to actually verify. It held up.
Frequently Asked Questions
Is it true that Google fixed more Chrome bugs in June than over the past two years, thanks to AI?
Yes. Chrome 149 and 150, both released in June 2026, fixed 1,072 security bugs combined, which is more than the 1,036 bugs Google patched across the previous 23 Chrome releases going back roughly two years, according to Google's July 30, 2026 security blog post.
What AI tools did Google actually use to find these bugs?
Google used Big Sleep, an LLM-based vulnerability hunter it built with Project Zero (successor to an earlier tool called Naptime), alongside a Gemini-based scanning harness deployed in early 2026 that reviews the Chrome codebase on an ongoing basis rather than on a per-request basis.
Do I need to do anything to get these security fixes?
No — just make sure Chrome is set to auto-update and restart the browser if it's been open a long time, since updates apply on restart. Check your version at chrome://settings/help.
How long does it take for a fix like this to reach regular Chrome users?
Chrome ships stable updates roughly every few weeks, and most users get them automatically within days of release, since Chrome checks for updates in the background without any action needed from you.
Is this the same across all browsers, or just Chrome?
Not identical. Microsoft reported a comparable AI-driven jump, patching 570 flaws in its June 2026 Patch Tuesday cycle. Apple's Safari-adjacent patching stayed at its normal pace — 482 bugs across 2026 — with no reported AI-driven acceleration as of this writing.