Google Says AI Helped Chrome Fix More Bugs in Two Releases Than the Past Two Years
Chrome 149 and 150 fixed 1,072 security bugs in June. The prior 23 releases, roughly two years, fixed 1,036 combined.
Chrome fixed more bugs in one month than the previous two years. AI agents did the finding.
Google says Chrome 149 and 150, both released in June 2026, fixed 1,072 security bugs between them. That is more than the 1,036 bugs fixed across the prior 23 Chrome milestones combined, roughly two years of releases.
How the number got that big
Chrome's director of engineering, Doug Turner, credits a Gemini-powered agent harness the team stood up earlier in 2026 that scans the codebase for vulnerabilities with fewer false positives than earlier tooling. A separate tool called Big Sleep, built by Google DeepMind and Project Zero, targets deeper finds, including inside the V8 JavaScript engine. One bug it caught had survived undetected for more than 13 years.
The pipeline behind the number
A multi-agent setup now automates most of triage: one agent reproduces a reported bug, another rates its severity, a third drafts a candidate patch, mimicking the back-and-forth of a human code review. Work that used to take a person 5 to 30 minutes per bug is now largely automated. In May alone, the automated tooling blocked more than 20 vulnerabilities before they ever shipped, including one Google rates as critical.
The tradeoff worth naming
Chrome carries more than 2,300 third-party dependencies, about 1,700 of them actually shipped in the browser. Faster fixing does not shrink that surface, it just processes it faster. TechCrunch's coverage points out Apple's own 2026 bug count, 482, has not moved anywhere near as fast, a reminder that this kind of jump depends on a team choosing to build the tooling, not something that happens automatically industry wide.
Why a build studio cares
This is a live demonstration of AI agents doing real security work at scale, not a demo. If it holds up over more release cycles, it is a template worth borrowing for any codebase a client asks us to harden, not just browsers.
Next step: read Google's own writeup or TechCrunch's coverage. If you want help wiring similar AI-assisted review into your own pipeline, write to us at hello@gattyworks.com.