Ethical Hacking News
Google's latest efforts to supercharge Chrome security have resulted in a significant improvement in vulnerability detection and patching capabilities. The company claims to have fixed 1,072 security bugs in just two releases using AI models, which is a substantial leap over previous milestones. This achievement highlights the potential of AI-powered vulnerability management pipelines and demonstrates Google's commitment to making its users' web experience safer.
Google's Chrome team used AI models to detect and fix 1,072 security bugs in just two releases. The team built an agent harness that utilized the Gemini AI model to improve vulnerability management pipeline efficiency and reduce false positives. A new method was implemented to run fixing, critic, and test-writing agents in tandem with integration into continuous integration (CI) systems. Google partnered with Google DeepMind and Project Zero to focus on external vulnerability reports and address "N-day" attacks. Chrome aims to eliminate entire bug categories rather than just patching individual instances using technologies like MiraclePtr and spanification. Chrome is working on dynamic patching, expanding its Rust SDK, and automating dependency updates to improve software security.
Google's Chrome team has recently announced that they have significantly improved their security capabilities using artificial intelligence (AI) models, resulting in the detection and fixing of an impressive 1,072 security bugs in just two releases. This is a substantial improvement over previous milestones, which had fixed a total of 1,072 security bugs across 23 releases.
The AI-powered vulnerability management pipeline has been instrumental in this achievement. The Chrome team built an agent harness that utilized the Gemini AI model to find vulnerabilities across the broader Chrome codebase with higher efficiency and lower false positives. This tool not only helped detect previously undetected security issues but also enabled the team to identify bugs that had silently survived in their codebase for over 13 years.
The current approach to fixing bugs at scale required a rethinking of the entire repair pipeline. The team implemented a new method that ran a fixing agent, a critic agent, and a test-writing agent in tandem, with all components being integrated into the continuous integration (CI) system running every 24 hours across all codebases. This allowed the team to proactively detect security bugs and block over 20 vulnerabilities from reaching production.
The external vulnerability reward program also saw an increase in reports, prompting a change to focus researchers on findings that add something beyond what internal AI tools are already catching. Google partnered closely with Google DeepMind and Project Zero for years, including on BigSleep and CodeMender, which are now natively integrated into their CI system.
The speed at which fixes reach users is just as crucial as the speed at which bugs are found. Google's Chrome team acknowledged that once a fix has landed and is visible in the public open-source codebase, attackers can start to reverse-engineer and exploit the bug before the fix reaches users' machines, referred to as "N-day" attacks or "patch gaps." To address this, Chrome is working on dynamic patching that replaces background processes on the fly without requiring a full restart.
In the long term, Chrome aims to eliminate entire bug categories rather than just patching individual instances. They are expanding MiraclePtr, a technology that neutralizes use-after-free vulnerabilities, and "spanification," which pushes spatial safety enforcement into the compiler rather than relying on runtime checks. This approach includes rewriting high-risk components in Rust, with Google building a centralized Rust SDK to make it a routine engineering choice.
Chrome's dependency problem is substantial, with over 2,300 third-party dependencies across Chromium and satellite projects, many of which ship to users in products ranging from Android devices to cloud enterprise stacks. To address this, Chrome has automated update pipelines that roll these dependencies to their latest upstream versions continuously, with safety signals from Google's Open Source Security Intelligence Platform providing guardrails against introducing new problems.
The integration of AI-powered vulnerability detection and patching capabilities has undeniably intensified the software security threat landscape but has also empowered defenders by combining rapid deployment mechanisms with deep structural defenses. By doing so, Chrome and the broader web become safer with every update.
Related Information:
https://www.ethicalhackingnews.com/articles/Google-AI-Supercharges-Chrome-Security-Fixing-1072-Bugs-with-Advanced-Vulnerability-Detection-and-Patching-Capabilities-ehn.shtml
https://securityaffairs.com/196408/ai/google-ai-supercharges-chrome-security-fixing-1072-bugs.html
Published: Fri Jul 31 11:34:56 2026 by llama3.2 3B Q4_K_M
