Google says its internal AI tools helped Chrome fix 1,072 security bugs across two browser releases in June—more than the 1,036 fixes recorded across the previous 23 releases over roughly two years.

The figures, disclosed alongside a Google white paper on AI-assisted vulnerability discovery and patching, offer a concrete example of how large language models are changing the economics of software security. For browser makers and enterprise IT teams, the development could mean more flaws are found before attackers exploit them—but also a much heavier operational burden for validating, prioritizing, and deploying fixes.

The comparison covers Chrome 149 and Chrome 150, the two “milestones” released in June, according to Google. The earlier period began with Chrome 126 in June 2024. Google has not provided independent validation of the numbers or a detailed breakdown showing how many fixes were directly generated, discovered, or accelerated by AI.

What Google says changed in Chrome security

Doug Turner, Chrome’s director of engineering, told TechCrunch that large language models have changed vulnerability discovery from a largely manual activity into an automated process operating at industrial scale. He said Google is applying models such as Gemini to identify and address flaws before attackers can use them.

That distinction matters. Google’s headline number describes bugs fixed in released versions of Chrome, not necessarily vulnerabilities found solely by an AI system. The company’s public account indicates that AI tools supported the broader workflow, which can include code analysis, identifying suspicious patterns, proposing fixes, and helping engineers move patches through testing and release processes.

The two June releases produced 1,072 security fixes combined, compared with 1,036 across the previous 23 releases. On a simple average, that is a sharp increase in fixes per release. But the comparison alone does not establish that AI caused every additional fix. Release scope, changes in reporting practices, security research activity, and Google’s definition of a security bug may also affect the total.

Google’s chart and white paper are therefore best read as evidence of a changing security operation, rather than as a controlled performance benchmark. The company is reporting the results itself, and the supplied evidence does not include a third-party audit of the methodology.

The wider AI-assisted vulnerability race

Google’s announcement follows a similar claim from Microsoft. Earlier in July, Microsoft said it patched a record 570 security flaws across its product lines during its monthly Patch Tuesday release and attributed the jump partly to its use of AI.

Together, the announcements support a long-standing cybersecurity concern: as AI systems become better at finding defects, defenders may discover more vulnerabilities at a faster rate. That can improve security when organizations patch quickly, but it can also expose weaknesses in products that were previously missed and increase the amount of work required from security teams.

The pattern is not uniform across major technology companies. An independent count cited by TechCrunch found that Apple had patched 482 bugs in 2026, putting it roughly on pace to match or exceed its total from the previous year. Apple did not respond to the publication’s request for comment, and the available evidence does not show whether its internal AI use differs from Google’s or Microsoft’s.

For now, the most defensible conclusion is that some large software vendors are reporting a substantial rise in security fixes alongside wider deployment of AI tools. It remains unclear how much of that increase reflects genuinely new discovery capacity versus changes in engineering processes or disclosure practices.

Why the numbers matter to browser and enterprise teams

Browsers are unusually exposed to this shift because they combine a large attack surface with frequent releases. Chrome contains complex components for rendering web pages, executing code, handling media, managing credentials, and connecting to operating-system services. A tool that finds a subtle defect in one of those areas can help Google reduce the time between discovery and remediation.

For product and security teams building on top of Google Chrome, the immediate implication is operational rather than theoretical. More frequent fixes can require faster browser validation, tighter patch-management processes, and clearer policies for distributing updates across employee devices. Enterprises that delay browser updates may face a wider gap between the discovery of a vulnerability and its deployment in the field.

AI-assisted vulnerability discovery also creates a verification problem. Automatically generated findings can include false positives, duplicate reports, or flaws that are difficult to reproduce. Suggested code changes need review and testing, particularly when a security patch could affect performance, compatibility, or other security controls. In a browser used by millions of people, a bad fix can create a new failure mode at scale.

The competitive pressure extends to attackers. If defensive systems can inspect code and identify weaknesses faster, offensive researchers and criminal groups may use similar capabilities to search public software, browser extensions, applications, and infrastructure. The resulting contest could make patch speed and secure deployment as important as the raw ability to find bugs.

What to watch next

The next useful signal will be more detail from Google about its measurement process. Security teams and researchers will want to know how many of the 1,072 fixes were discovered by AI, how many were suggested or implemented with model assistance, and how Google measured the time saved.

Chrome’s future release data will also show whether June was an unusual spike or the beginning of a sustained increase. A broader comparison across multiple browsers could help separate Google-specific process changes from a wider industry trend.

Enterprise buyers should watch for changes in Chrome’s patch cadence, emergency update frequency, and guidance for automated deployment. They should also assess whether their own security tooling can triage a larger volume of vulnerability findings without overwhelming engineering teams.

Finally, independent researchers may examine whether the rising fix counts correspond to lower exploitation rates, shorter remediation windows, or fewer serious vulnerabilities reaching users. More bugs fixed is an important operational measure, but it is not by itself proof that overall risk has fallen.

Creati.ai perspective

Google’s Chrome figures make the AI-security debate more tangible. The important change is not simply that a model can locate a bug; it is that AI may compress several steps in the security lifecycle, from finding a weakness to preparing a patch. That could give well-resourced vendors a meaningful advantage in protecting widely used software.

But the same acceleration raises the value of disciplined review. If discovery becomes abundant, prioritization, validation, and deployment become the bottlenecks. For builders and enterprise security leaders, the strategic question is less whether to use AI and more whether their engineering systems can safely process the volume it creates.