Google says AI helped Chrome fix more bugs in June than in the previous two years combined

Google said it patched more Chrome security bugs in June 2026 than it fixed across the previous two years combined, underscoring how AI is rapidly changing the economics of vulnerability hunting. The company credited internal AI tools, including Gemini-based systems, for accelerating the discovery and repair of flaws in its browser.

In a white paper published Thursday, Google said it fixed 1,072 security bugs across its last two Chrome releases in June, topping the 1,036 fixes recorded across the 23 releases that came before them over roughly two years. The milestone is one of the clearest public signs yet that AI-assisted security research is beginning to scale at the same pace as the systems it is meant to defend.

What Google says happened in Chrome

Google’s figures point to a steep jump in the company’s bug-fixing output, and the timing matters. Chrome 149 and Chrome 150, released in June 2026, accounted for the bulk of the newly patched vulnerabilities, while the earlier set of 23 “milestone” releases stretched back to Chrome 126 in June 2024.

That comparison is not just a flattering statistic for Google. It reflects a broader shift in defensive security work, where automated analysis can now surface issues faster than traditional manual review alone. In Google’s telling, the browser is becoming safer partly because machines are finding weaknesses before attackers can weaponize them.

Doug Turner, Chrome’s engineering director, said in a statement that large language models have changed the underlying math of cybersecurity by making vulnerability discovery more automated and far more scalable. He said Google is using models such as Gemini to identify problems earlier and reduce exposure before malicious actors can exploit them.

Turner said LLMs have “fundamentally shifted the economics of cybersecurity,” describing vulnerability discovery as an increasingly industrial, automated process.

He added that by using Gemini-like models, Google is “preemptively fixing vulnerabilities” and pushing Chrome updates that are safer with each release.

Why this matters for cybersecurity

The Chrome numbers fit a prediction many security researchers have been making since the rise of generative AI: if AI can help defenders, it can also help attackers, which should force both sides into a faster, more automated arms race. Google’s public data suggests that warning is no longer theoretical.

For years, software security teams have struggled with a painful imbalance. Modern codebases are enormous, vulnerabilities are often subtle, and the manual work needed to identify and verify bugs can take far longer than it takes an attacker to test and exploit them. AI tools can compress that timeline by scanning code, highlighting suspicious patterns and suggesting fixes at a scale humans alone cannot match.

At the same time, the same capabilities can be used offensively to generate malicious code, automate reconnaissance or help adversaries search for weak points in software and services. That dual-use nature is why the rapid adoption of AI in security has been greeted with both enthusiasm and caution.

How Google’s numbers compare with recent industry trends

Google is not alone in reporting an unusually large jump in security fixes. Microsoft said earlier this month that it had addressed a record 570 flaws across its product portfolio as part of its monthly Patch Tuesday cycle, and the company also tied the increase to its use of AI tools.

Those disclosures suggest a broader pattern across the largest software vendors: AI is not only being layered into user-facing products, but also into the internal machinery of software maintenance, code review and vulnerability response. The result is a faster cadence of discovery, triage and patching.

Apple, by contrast, does not appear to be seeing the same sharp acceleration. Based on an independent count of fixes in its products, Apple has patched 482 bugs so far in 2026, which is broadly on track with last year’s total and roughly similar to the company’s pace from a decade ago. Apple did not immediately respond to a request for comment.

How the Chrome figures break down

Google’s white paper offers a useful snapshot of how dramatic the increase has been. The company’s own chart shows that the latest June releases dramatically outpaced the preceding two years of Chrome updates in terms of total bugs fixed.

Here is a simplified look at the numbers Google highlighted:

The comparison is imperfect, because different companies release software on different schedules and use different methods for counting bugs. Even so, the scale of Google’s reported increase is unusually stark and likely to draw attention from both security teams and AI developers.

What AI is doing inside Google’s security workflow

Google has not said that AI is replacing human security engineers. Instead, the company’s public message points to a human-plus-machine workflow in which models help spot suspicious code paths, rank likely vulnerabilities and accelerate the drafting of fixes. That division of labor is important: AI may be doing the first pass, but human reviewers still need to verify whether a finding is real, exploitable and worth patching.

This approach aligns with how AI is increasingly being used across software development. The most effective deployments are usually not fully autonomous systems, but assisted workflows where models handle repetitive scanning, code summarization, test generation and triage while experts make the final call.

In security, that means AI can turn a task that once required weeks of manual review into something much closer to a continuous pipeline. The business implication is significant. Companies that can discover and patch flaws sooner reduce the risk of breach, cut the cost of incident response and protect user trust.

What counts as a Chrome “milestone” release?

Google calls each numbered Chrome version a milestone, and the company used those milestones to compare its recent patch output against prior releases. That framing makes the trend easier to visualize because it groups fixes by major update rather than by a narrow patch cycle.

The point of the comparison is not that every update since 2024 was unusually quiet. Rather, Google is showing that the latest AI-assisted workflow appears to be driving a structural change in how much security work can be done per release window.

Why attackers are paying attention too

Faster patching is good news, but it also signals that the threat landscape is changing. If defenders can use AI to uncover flaws at scale, attackers can use the same class of tools to probe systems, write exploit code faster or automate parts of the attack chain.

That is why security experts have long argued that the AI era would not simply produce more bugs or fewer bugs. It would produce more bug-finding, more patching, more scanning and more pressure on defenders to shorten the time between discovery and remediation.

Google’s announcement suggests that this shift is already underway in one of the world’s most widely used browsers. Chrome’s enormous install base makes every security gain valuable, but it also makes the browser a prime target for exploitation. Any improvement in patch speed can have a meaningful effect on global exposure.

How Google’s announcement fits the larger AI cycle

Google’s disclosure arrives at a moment when AI is increasingly embedded in core infrastructure rather than novelty products. The technology is no longer just about chatbots and content generation. It is being folded into software engineering, threat detection, malware analysis, customer support and internal operations.

That shift matters because it changes what enterprises are buying when they invest in AI. They are not only seeking visible product features; they are also buying efficiency gains inside the organization. In Google’s case, the payoff is measurable in the number of defects that can be found and fixed.

The company’s Chrome data also offers a glimpse into how large vendors may market their AI investments going forward. Rather than describing abstract productivity benefits, they can point to concrete security gains, such as more bugs fixed, fewer vulnerabilities left open and quicker remediation timelines.

How much can readers trust the numbers?

Google’s figures should be treated as company-reported data and read in context. The raw count of bugs fixed does not tell the full story of severity, exploitability or user impact, and different organizations use different standards for categorizing vulnerabilities.

Still, the scale and direction of the trend are hard to dismiss. A jump from 1,036 fixes across 23 releases to 1,072 fixes across two releases is notable even allowing for counting differences. It suggests a real operational change, not just a reporting anomaly.

What to watch next

The next question is whether Google can sustain this pace, and whether other vendors see similar gains as their internal AI systems mature. If the Chrome trend continues, it could become a benchmark for how AI reshapes software defense across the industry.

Security teams will also be watching whether faster patching translates into fewer real-world incidents or whether attackers adapt just as quickly. The most important measure is not simply how many bugs get fixed, but whether the window of exploitable exposure continues to shrink.

For now, Google’s message is clear: AI is no longer an experimental add-on in browser security. It is beginning to act like a force multiplier, one that can uncover more flaws, speed up fixes and potentially change the balance between defenders and attackers.

That makes Chrome’s June patch surge more than an internal engineering milestone. It is a sign that the AI-driven security era has moved from prediction to production.

For cybersecurity teams, the lesson is straightforward: AI is becoming part of the patch management stack, and the companies that use it well may move faster than the threats they face.