Google Moves Chrome to Twice-Weekly Security Updates as AI Bug Hunting Floods Pipeline

Google is piloting a twice-weekly security update schedule for its Chrome browser after AI-assisted vulnerability discovery produced a surge in bug fixes unlike anything the team has seen before. The shift was reported in July 2026, following a Chrome security team report published that month.

Chrome’s two major version releases in June 2026 included fixes for 1,072 security bugs — more patches than the team shipped across the prior 23 major releases combined. The spike has been driven largely by the Chrome security team’s expanded use of AI tools for vulnerability discovery, triage, and patch development.

“The way we ended up here is we had so many vulnerability fixes, so being able to provide two [updates per week] during this time, it made the most sense to us,” said Doug Turner, Chrome’s director of engineering. “Will that last forever? Who knows.”

Chrome was already moving toward a standard cadence of one major release every two weeks with additional weekly security updates. The twice-weekly pilot represents a further acceleration driven by the volume of newly discovered flaws.

Turner explained that the team is training its AI model on every past security vulnerability and every line of code in Chromium’s history, including the reasons behind each change. This allows the tools to identify weaknesses across Chrome’s codebase — including in features no longer under active development.

Parisa Tabriz, Chrome’s vice president and general manager, noted that Google has used machine learning for vulnerability discovery since at least 2012, but described 2026 as “an inflection point both for offense and defense.” She and Turner also said the current surge may not be permanent, as AI tools tend to exhaust discoverable bugs in mature, stable software over time.

Beyond patching, the Chrome team is also pursuing structural fixes — such as rewriting portions of C++ code in the memory-safe programming language Rust — to eliminate entire categories of common vulnerabilities rather than addressing bugs one at a time.

Source: WIRED

This article was generated by AI and cites original sources.
Scroll to Top