Ethical Hacking News
Google recently addressed 1,442 security flaws with recent Chrome updates. The company has implemented various measures to enhance security, including two-week release cadence for major milestones and automated update pipelines for third-party dependencies. This comes as vulnerability discovery rates surge due to AI-powered attacks, highlighting the need for continued improvement in browser security.
Google has released patches for Chrome versions 149 and 150, addressing 1,072 security bugs, surpassing prior milestones. The exponential surge in vulnerability discovery is attributed to large language models accelerating bug reports. A critical sandbox escape in the Navigation component (CVE-2026-3545) was patched after remaining undetected for over 13 years. Google is piloting two security releases per week and automating release notes and CVE descriptions to mitigate manual bottlenecks. The company is hardening the runtime environment, transitioning to memory-safe languages, and implementing a top-level user interface using HTML, CSS, and TypeScript. Google aims to drive toward a browser that is continuously protected without disrupting the user experience.
Google has recently released patches for Chrome versions 149 and 150, addressing a total of 1,072 security bugs. This surpasses the cumulative number of flaws fixed across the company's prior 23 milestones combined. In its latest release, patch for Chrome 151, Google resolved 370 flaws, out of which 349 were reported by the company itself. Seven of these vulnerabilities have been marked critical in severity.
The exponential surge in vulnerability discovery has been attributed to the advent of large language models (LLMs) that have accelerated the process. This has led to an unprecedented spike in new bug reports, with issues being flagged at a faster rate than companies can fix them. According to statistics shared by the U.S. National Vulnerabilities Database (NVD), 46,872 flaws have been recorded so far in 2026, nearing the 49,920 vulnerabilities reported for the entirety of 2025.
One such vulnerability discovered in the Chrome codebase is a critical sandbox escape in the Navigation component (CVE-2026-3545), which could be exploited to trick the browser into reading local files from the user's system. This vulnerability was patched by Google earlier this March using an agent harness leveraging its Gemini models, and remained undetected for over 13 years.
The tech giant stated that it is piloting a shift to two security releases per week in the face of "fast-moving, AI-powered attacks." Even with this pace, proper public disclosure remains paramount. Every security bug that reaches Chrome Stable, regardless of whether it was discovered internally or reported externally, is documented and disclosed publicly as a standard best practice.
Google also mentioned that it's working on automating efforts to generate release notes and CVE descriptions from security bug fixes to mitigate manual bottlenecks and further shorten the window between vulnerability discovery and public disclosure. Furthermore, Google is taking steps to eliminate entire classes of security issues from Chrome by hardening the runtime environment, transitioning to memory-safe languages like Rust, and implementing the browser's top-level user interface using HTML, CSS, and TypeScript.
In addition, the company said it's moving all Chrome third-party dependencies onto automated update pipelines to ensure they are up-to-date. "Every bug found and fixed is one less foothold for an attacker," Google's Chrome Security Team stated. "But discovering and fixing a bug is only half the battle - we must also ship the fix and apply the update for users faster than adversaries can exploit the bug, and invest in projects that mitigate or eliminate classes of bugs through accelerated release cadences, dynamic patching, and opportune restarts."
Ultimately, Google aims to drive toward a browser that is continuously protected without disrupting the user experience.
Related Information:
https://www.ethicalhackingnews.com/articles/Google-Addresses-1442-Chrome-Security-Flaws-with-Recent-Patch-Releases-ehn.shtml
https://thehackernews.com/2026/07/three-recent-chrome-releases-fix-1442.html
Published: Fri Jul 31 11:23:16 2026 by llama3.2 3B Q4_K_M
