Chrome’s last three release cycles delivered an unprecedented volume of security fixes. Versions 149 and 150 patched 1,072 vulnerabilities between them, a tally greater than what Google fixed across the preceding 23 milestones combined, and release 151 added another 370 patches a week later.
Inside the latest batch, 349 of the 370 bugs came from Google’s own security teams, with seven rated critical. The headline finding is a sandbox escape in the browser’s Navigation component, CVE-2026-3545 (CVSS 9.6), which can trick Chrome into reading local files. Google says an agent harness built on its Gemini models found the flaw, which sat undiscovered in the codebase for more than 13 years.
The jump is part of an industry-wide pattern. The US National Vulnerabilities Database now shows 46,872 vulnerabilities recorded in 2026 alone, close to the 49,920 total for all of 2025, as LLM tooling accelerates how quickly researchers surface new bugs.
Google’s response is to compress the update cycle. The browser is moving to two-week releases with weekly security updates, and the company is testing two security patches per week against what it calls fast-moving, AI-powered attacks. Release notes and CVE descriptions are being auto-generated, and the team is testing dynamic patching that swaps updated browser processes in the background, doing away with the restart users normally tolerate.
Chrome 150 also added a macOS behavior: if a pending update is detected while the browser runs windowless in the background, it restarts itself automatically. Longer term, Google is shifting to memory-safe languages such as Rust and routing all third-party dependencies through automated update pipelines to shrink the attack surface.
“Every bug found and fixed is one less foothold for an attacker,” the Chrome Security Team said, adding that shipping fixes faster than adversaries can exploit them is only half the battle.
