Loading story…
Google said expanded use of AI across Chrome’s security workflow helped it identify and remediate 1,072 security bugs in Chrome 149 and Chrome 150, a total that exceeded the number fixed across the prior 23 Chrome milestones combined. The company said large language models and Gemini-based systems are now being used for vulnerability discovery, reproduction, severity assessment, bug routing, patch generation, test creation, code review, and update delivery. Google also said AI-assisted analysis uncovered a sandbox escape flaw that had existed for more than 13 years and could have allowed a compromised renderer to access local files.
Google attributed the spike in fixes to improved detection rather than a decline in Chrome security, describing AI as a way to scale vulnerability hunting and preemptive remediation across a massive codebase. To shorten the window between patch creation and user protection, the company is piloting twice-weekly security releases and developing dynamic patching and less disruptive automatic restart mechanisms. Google also said it is expanding memory-safety efforts such as MiraclePtr, moving new components to Rust, scanning code changes with AI before merge, and improving third-party component update pipelines.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
Google reported that Chrome 149 and Chrome 150, both released in June, contained fixes for 1,072 security bugs. The company said this exceeded the total number of bugs fixed across the prior 23 Chrome milestones combined.
Google said DeepMind and Project Zero tools integrated into Chrome’s continuous integration environment prevented more than 20 vulnerabilities, including one critical issue, from reaching production. The disclosure was presented as a concrete outcome of the company’s expanding AI-assisted security pipeline.
Google patched CVE-2026-3545, a critical Chrome Navigation component sandbox escape flaw with a CVSS score of 9.6 that could allow local file reads. The vulnerability had reportedly existed undetected for more than 13 years before being fixed.
Google said its Big Sleep AI agent, combined with Google Threat Intelligence, discovered the critical SQLite vulnerability CVE-2025-6965 and helped stop its exploitation before it occurred. The company described this as the first known case of an AI agent directly foiling attempts to exploit a vulnerability in the wild.
Google said OSS-Fuzz had been tested with large language models to automatically generate new fuzz targets for open source projects, increasing code coverage by roughly 1.5% to 31% in evaluated cases. The company also said an LLM-generated OpenSSL target rediscovered CVE-2022-3602 in previously uncovered code and planned to open source the evaluation framework.
Google said it enabled BackupRefPtr, the core of its MiraclePtr mitigation against use-after-free exploitation, for Chrome's browser process on Windows and Android in Chrome 102 Stable. The company said it had rewritten more than 15,000 raw pointers and estimated the mitigation could protect roughly half of browser-process use-after-free issues from exploitation.
Google said it is testing a pilot release cadence for Chrome security updates twice per week to respond to faster vulnerability discovery and reduce the delay between patch publication and user protection. The company said the change is motivated in part by increased AI-assisted flaw discovery and rising external bug report volume.
Google said it expanded AI use across Chrome's vulnerability management lifecycle, including flaw discovery, triage, patch generation, code review, and update delivery. It also said it is piloting more frequent security releases and developing faster patch deployment mechanisms.
Google reported that Chrome 151 alone contained 370 security fixes, extending the elevated patching pace it had previously highlighted for Chrome 149 and 150. The disclosure was cited alongside broader claims that Chrome bug fixes in 2026 had exceeded 1,800.
Google said a Gemini-based system uncovered a Chrome sandbox escape vulnerability that had existed for more than 13 years and could have allowed a compromised renderer to access local files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
18 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcetechrepublic.com
Open sourcezdnet.com
Open sourcexakep.ru
Open sourceblog.google
Open sourcesecurity.googleblog.com
Open sourcesecurity.googleblog.com
Open sourcenvd.nist.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has released a major Chrome Stable update that patches **151 security vulnerabilities**, including **22 critical flaws** affecting desktop builds on Windows, macOS, and Linux, with related fixes also noted for Android and iOS. The patched desktop versions are `148.0.7778.216/217` for Windows, `148.0.7778.215/216` for macOS, and `148.0.7778.215` for Linux. Google and national cyber authorities urged users and administrators to update immediately, while the company temporarily withheld detailed technical information until most users receive the fixes. Google said none of the newly disclosed critical issues were known to be exploited in the wild at disclosure time. The most serious bugs include **CVE-2026-9872** in the GPU process, **CVE-2026-9873** in Network, **CVE-2026-9874** in Dawn, and **CVE-2026-9875** in WebGL, alongside numerous flaws in **ANGLE**, Bluetooth, Base, Proxy, media, and other browser components. The vulnerabilities span use-after-free, out-of-bounds read and write, integer overflow, race condition, and insufficient validation weaknesses that could enable **remote code execution**, sandbox escape, data corruption, or broader system compromise through malicious web content. Google said many issues were found internally through fuzzing, sanitizers, and control-flow integrity tooling, while external researchers also reported multiple bugs through the bounty program, with rewards reaching **$43,000**.
Jun 29, 2026
Google has released **Chrome 148** to the stable channel for Windows, macOS, Linux, and Android, patching **127 security vulnerabilities** in one of the browser’s largest security update batches. The release fixes three **Critical** flaws: `CVE-2026-7896`, an integer overflow in **Blink** that could lead to heap corruption via a crafted HTML page, plus `CVE-2026-7897` and `CVE-2026-7898`, two use-after-free bugs affecting **Mobile** and **Chromoting**. Google said no active exploitation had been reported at release, but urged users to update to **148.0.7778.96/97** immediately; Canada’s cyber agency also advised administrators to apply the update for affected desktop versions prior to those builds. The advisory also covers more than two dozen high-severity issues across major Chromium components including **V8, ANGLE, WebRTC, GPU, Skia, UI, DevTools, Printing, Audio, ChromeDriver, and AdFilter**, many involving memory-safety errors such as use-after-free, type confusion, out-of-bounds access, and insufficient validation of untrusted input. Public CVE records tied to the release include `CVE-2026-7987`, `CVE-2026-7988`, `CVE-2026-7991`, `CVE-2026-7992`, `CVE-2026-7995`, `CVE-2026-8000`, `CVE-2026-8001`, `CVE-2026-8002`, `CVE-2026-8016`, and `CVE-2026-8018`, several of which could enable code execution inside Chrome’s sandbox or, in some cases, potential sandbox escape. Google credited internal testing tools such as fuzzers and sanitizers along with external researchers, paid at least **$138,000** in bug bounties, and withheld details for some issues until most users receive fixes; because the bugs affect Chromium, downstream browsers and enterprise Chromium deployments may also need corresponding updates.
Jun 29, 2026
Google has released a major Chrome security update fixing **382 vulnerabilities** across Windows, macOS, Linux, iOS, and Android, including **15 critical** and **67 high-severity** flaws. The patched bugs span components such as **Extensions, GPU, WebUSB, Browser, Bluetooth, Chromoting, Ozone, Dawn/WebGPU, ANGLE, Skia, Views, Fullscreen, and iOSWeb**, with many involving `use-after-free`, `type confusion`, out-of-bounds access, uninitialized use, and insufficient validation of untrusted input. Google said **358** of the issues were found internally through tooling and fuzzing, while others were reported by external researchers. Several of the vulnerabilities could be triggered through crafted web content to achieve renderer compromise, heap corruption, control-flow hijacking, and in some cases **sandbox escape** leading to code execution on the underlying system. Reported examples include **CVE-2026-13789**, a high-severity `use-after-free` flaw in the GPU component that could enable a remote attacker with renderer access to escape the sandbox, along with critical issues such as **CVE-2026-13774**, **CVE-2026-13775**, **CVE-2026-13776**, **CVE-2026-13778**, **CVE-2026-13782**, **CVE-2026-13785**, and **CVE-2026-13788**. Google said it had **no evidence of in-the-wild exploitation** at release, but urged rapid deployment of the update, particularly in enterprise environments and for Chromium-based browsers.
Jul 12, 2026