Google Patches More Chrome Bugs in One Month Than the Previous Two Years Combined, Shifts to Twice-a-Week Updates

Google patched 1,072 security flaws in the Chrome browser across two major version releases in June 2026. That single month of fixes exceeds the total number of bugs squashed in the previous 23 versions, which accumulated 1,036 patches over roughly two years. The Chrome security team published a chart showing the two June updates alone outpaced the entire preceding two-year period, a visual that TechCrunch described as a stark illustration of the new reality.

The numbers break down further. One update, Chrome 150, addressed 382 security fixes, 15 of which were rated critical, according to Malwarebytes. A subsequent Chrome 150 point release patched 27 additional vulnerabilities, including two critical-severity bugs, SecurityWeek reports. Wired notes that the two June updates patched more bugs than the 23 updates before them, a statistic that forced Google to rethink its entire release philosophy.

Google expanded its use of AI across Chrome's entire security workflow in 2026, deploying a Gemini-based system that searches the codebase for vulnerabilities, triages incoming bug reports, generates patches, and reviews code. The Chrome Security team explained that triaging a single security report historically took 5 to 30-plus minutes and relied on human expertise. The automated approach blending rule-based systems with AI increased both throughput and accuracy, Helpnetsecurity reports.

Wired frames this as an arms race. For two years, cybersecurity experts warned that LLMs would find an increasingly enormous number of bugs, forcing defenders to also use AI to get ahead of malicious hackers. That prediction is now backed by real data. The sheer volume of bugs AI can surface means the bottleneck shifted from finding vulnerabilities to fixing and shipping them fast enough to stay ahead of attackers, TechCrunch notes.

How the patching cadence changed in response Google moved Chrome to a two-week milestone cadence in 2026, Windowsforum reports, a dramatic acceleration from the six-week cycle that was once considered aggressive. Wired puts the new rhythm even more bluntly: Chrome now needs twice-a-week patching thanks to AI bug hunting. The browser that pioneered automatic updates a decade ago now distributes security fixes at a pace that would have seemed absurd just a few years ago.

The Chrome security team frames this as the new normal. The race to deliver patches is on, and the quantity and frequency of updates is spiking across all software categories, not just browsers. Microsoft's biggest ever Patch Tuesday in the same period fixed 206 bugs, including three zero-days, Malwarebytes points out, suggesting an industry-wide phenomenon rather than a Chrome-specific anomaly.

Google's automated pipeline now handles vulnerability discovery, triage, patch generation, and code review. The Chrome Security team said they have been shifting the triage process toward automation that combines rule-based systems with AI. The goal is to shrink the window between discovery and delivery, closing the gap before attackers can exploit what the AI finds.

Helpnetsecurity reports that AI-generated patches are increasingly landing in production builds without human intervention for lower-severity issues. For critical bugs, the AI still flags them for human review, but even that handoff is faster because the system pre-writes the fix and the justification. The entire flow, from fuzzer output to shipped patch, has been sanded down by AI at every step.

The Chrome data validates a prediction that has hung over the security industry since LLMs entered the mainstream. AI-powered systems are finding bugs at a rate that overwhelms traditional human-driven patching schedules. TechCrunch frames this as the beginning of a trend: Microsoft and now Google are finding and patching an exponential number of bugs, and every major software vendor will face the same pressure.

Wired goes further, calling it an AI-era bug hunting arms race. The same tools that let defenders find flaws also let attackers find them. The only defense is speed, shipping fixes before anyone else can write exploits. Google's approach, automating every link in the chain from discovery to deployment, is becoming the template for how large-scale software security must operate going forward.

Chrome users should expect a constant stream of updates, not the occasional large patch. The new cadence means IT departments and individual users will see browser restarts and update prompts far more frequently. Malwarebytes advises users not to wait for the automatic rollout and to manually trigger updates immediately through Chrome's About menu.

The Chrome security team frames the increased update frequency as a sign of strength, not weakness. In a blog post, they said Chrome is stronger with every update, and the faster pace reflects a more secure browser, not a more broken one. But the practical burden on enterprise IT teams, who must test and deploy each release, is real and growing. What was once a monthly maintenance task is becoming a weekly operational rhythm.