Loading story…
Google has shifted Chrome desktop and mobile releases from a four-week to a two-week cadence, shortening the time between public Chromium fixes and their availability to users. The company cited faster vulnerability discovery, exploit development, and spearphishing enabled by advanced and agentic AI, and said it is testing delivery of two security updates per week. Google is also developing dynamic patching intended to reduce or eliminate browser-restart requirements.
Organizations using Chrome Enterprise's Extended Stable channel will continue to receive major releases every eight weeks, but critical security fixes will be backported and deployed weekly. Security teams should verify that managed Chrome fleets can receive interim security updates promptly and reassess patch-compliance monitoring as Chrome's release cadence increases.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Google disclosed that it is developing an early-stage dynamic-patching capability intended to reduce or eliminate the need for users to fully restart Chrome after updates. While it is under development, Google is optimizing background restarts and session restoration.
Google said it is testing a cadence of two Chrome security updates per week as part of its effort to shorten exposure to publicly visible Chromium vulnerabilities.
Google changed Chrome desktop and mobile releases from a four-week cadence to a two-week cadence, reducing the maximum standard interval from a public Chromium fix to user availability from 28 days to 14 days. Google said the security-driven change addresses the faster discovery and exploitation of vulnerabilities, including risks accelerated by AI.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google announced it will shift **Chrome** from a four-week to a **two-week** release cycle for **Stable** (and corresponding **Beta**) builds across **desktop, Android, and iOS**, starting with **Chrome 153** scheduled for **September 8**. Google said the more frequent releases will be smaller in scope, aiming to reduce user disruption and simplify post-release debugging while maintaining stability due to internal process improvements. For enterprises, Google is not changing the **Extended Stable** option, which will continue on an **eight-week** cadence for organizations that prioritize longer validation windows. Google’s enterprise guidance positions the new fortnightly Stable cadence as the “most secure option” when security outweighs maintenance overhead, while noting that Chrome’s existing model of **weekly security updates** (introduced to reduce the “patch gap”) remains in place alongside the milestone releases.
Jun 29, 2026
Google released Chrome 153 for Windows, macOS, Linux, Android, and iOS, fixing 230 reported security vulnerabilities, including **CVE-2026-87491**, an out-of-bounds write in the V8 JavaScript and WebAssembly engine that is reportedly being exploited in the wild. The release includes five critical and 43 high-severity fixes across WebGL, Cast, ANGLE, PDFium, V8, and WebView; organizations should prioritize updating managed browsers to `153.0.8010.36` or later. Google has formally reduced Chrome's stable release cycle from four weeks to two weeks, aiming to shorten the N-day window between public disclosure of a flaw and deployment of a patch. The company cited a growing volume of reports and automated AI-assisted security work, alongside faster-moving AI-enabled threats, as drivers for the accelerated cadence; the schedule will also speed delivery and iteration of Chrome features, including AI capabilities.
Sep 10, 2026
Google said expanded use of AI across Chrome’s security workflow helped it identify and remediate **1,072 security bugs** in Chrome 149 and Chrome 150, a total that exceeded the number fixed across the prior 23 Chrome milestones combined. The company said large language models and Gemini-based systems are now being used for vulnerability discovery, reproduction, severity assessment, bug routing, patch generation, test creation, code review, and update delivery. Google also said AI-assisted analysis uncovered a **sandbox escape** flaw that had existed for more than 13 years and could have allowed a compromised renderer to access local files. Google attributed the spike in fixes to improved detection rather than a decline in Chrome security, describing AI as a way to scale vulnerability hunting and preemptive remediation across a massive codebase. To shorten the window between patch creation and user protection, the company is piloting twice-weekly security releases and developing dynamic patching and less disruptive automatic restart mechanisms. Google also said it is expanding memory-safety efforts such as **MiraclePtr**, moving new components to **Rust**, scanning code changes with AI before merge, and improving third-party component update pipelines.
Aug 6, 2026