SAN FRANCISCO – Chrome updated itself on your device last month. You probably clicked Relaunch, watched the window flicker, and moved on. What you did not see was the number underneath: 1,072.
That is how many security bugs Google fixed across Chrome 149 and 150, both released in June. Google disclosed the milestone on Thursday, and the figure carries a twist: 1,072 is more than the 1,036 flaws patched across the previous 23 Chrome versions, a span covering roughly the last two years. The browser used by billions of people effectively doubled its entire recent patching history in a single month, without a headline about it until now.
The explanation, according to Google, is Gemini.
Chrome’s director of engineering, Doug Turner, said in a statement to TechCrunch that AI tools have “fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation.” By applying models like Gemini, Google is, in Turner’s words, “preemptively fixing vulnerabilities, outpacing our adversaries and making Chrome safer with every update.”
The phrase “automated, industrial-scale operation” is doing significant work. For most of Chrome’s history, finding security bugs required a researcher, a testing environment, and enough time to work through tens of millions of lines of code. AI models change that equation fundamentally: they can generate, run, and evaluate test cases at a pace that no human team can match, which is why a single two-release cycle could produce more patch material than two full years of conventional review.
Google published a white paper alongside Thursday’s announcement, charting the exponential increase. The comparison baseline is Chrome 126, released in June 2024. By Chrome 149 and 150, both released last month, the curve bends sharply upward. The visual is effectively a cliff edge, and it surfaces a question the white paper does not answer directly: if AI can find bugs at that pace on the defensive side, adversaries have access to the same tools.
Google is not alone in watching its patch numbers surge. As Eastern Herald reported in June, Microsoft’s Patch Tuesday that month fixed a record 206 vulnerabilities across Windows, Office, Exchange, and related products, a 71 percent jump over the May cycle. Microsoft attributed the increase explicitly to AI-assisted vulnerability discovery, with its engineering leadership warning that releases at that scale could become the new baseline. According to Microsoft’s own figures at the time, the company patched 570 security flaws across its products in that single monthly cycle.
Apple appears to be on a different trajectory. According to an independent count of vulnerabilities fixed across Apple products, the company patched 482 bugs in 2026, a pace roughly on track to equal or slightly exceed its 2025 total and consistent with its historical rate going back to 2015. TechCrunch contacted Apple for comment and received no response. What Apple’s flat line means is genuinely unclear: it could reflect different security practices, slower internal AI adoption, a more controlled product surface, or simply a different methodology for counting and disclosing fixes.
The comparison matters because it surfaces a question that Chrome users cannot answer from the outside. When a browser goes from patching roughly 45 bugs per release cycle to patching 536, the jump could mean a few different things: the vulnerabilities were always present and AI is finally exposing them, the increased complexity of Chrome’s AI-integrated features is generating new attack surfaces, or both dynamics are operating simultaneously. Google’s white paper leans toward the first reading, but the data it presents cannot distinguish between these cleanly.
There is also historical context worth placing alongside Thursday’s numbers. Chrome recorded five actively exploited zero-days by mid-June this year, three of them in the V8 JavaScript engine at the browser’s core. None of the 1,072 bugs patched in Chrome 149 and 150 were confirmed as actively exploited at the time of release. Whether that means AI found them before adversaries did, or whether attackers discovered different bugs through similar AI tools and chose not to disclose them, is something Thursday’s announcement cannot establish.
Turner’s statement addresses the supply side of security, not the demand side. A company finding 1,072 bugs and patching them before anyone exploits them is, by any reasonable measure, a good outcome. The harder version of the same question is what happens when an adversary running the same model finds the 1,073rd bug first and does not publish it.
There is an operational dimension to this shift that Google’s announcement does not address. Chrome releases major versions roughly every four weeks. Enterprise IT teams managing the browser across large device fleets are already under pressure to test and deploy updates faster than their internal cycles allow. A near-doubling of patch volume does not reduce that pressure. Organizations that cannot simply click Relaunch are absorbing this acceleration differently than individual users are.
What Thursday’s announcement establishes, with hard numbers and a named source, is that AI has crossed a practical threshold in software security. The era of finding vulnerabilities at artisanal scale is over for at least one major browser. The question that remains unanswered is whether patching them at industrial scale is enough, when the capability to find them at industrial scale is available to anyone running a large language model.
