Google explains how they used AI to fix a large number of Chrome bugs.
Google explains its system for using AI to find and fix bugs in its web browser, Chrome. Apparently, the number of bugs fixed in Chrome has increased dramatically as AI performance has improved.
Stronger with every update: How we're making Chrome and the web safer in the AI Era
The process of finding and fixing bugs in Chrome follows these steps: 'Discover bugs,' 'Prioritize bugs,' 'Fix bugs,' 'Release the corrected Chrome,' and 'Users install the corrected Chrome.' Google is using AI to speed up the process from bug discovery to fixing, and is also working to speed up the process of applying the fix to users.
◆Find the bug
Since 2023, Google has been building a security system using Large-Scale Language Models (LLMs), and in 2024, it developed a vulnerability detection tool called '
In early 2026, they built an agent harness using Gemini to discover vulnerabilities in Chrome and successfully uncovered a vulnerability that had been lurking in the codebase for 13 years, allowing it to ' escape the sandbox and load arbitrary files into Chrome .' They continued to improve the harness, introducing features such as 'interoperability that leverages the strengths of Google's models and open models,' 'promotion of SECURITY.md among developers,' 'building a critic agent to process SECURITY.md,' and 'a mechanism to run the detection flow multiple times to address the non-determinism and improvements of the model.'
◆ Prioritize bugs
They are also using AI to prioritize bugs. Specifically, they are performing the following tasks. This prioritization has reportedly reduced the time human developers spend working on bugs by several hundred hours each month.
Noise reduction: Verify that AI-generated bug reports clearly describe vulnerabilities and are not duplicated.
Bug reproduction: Create proof-of-concept code and test it on affected operating systems and Chrome versions.
Add metadata to reports: Add metadata such as the date and time the vulnerability occurred and its severity rating to the report.
Automatic assignment: Assigns the appropriate person to handle the task.
◆ Fix bugs
Bug fixes are also created using AI. The system involves a 'fix agent' generating multiple candidate code snippets, and a 'critique agent' selecting the optimal code. Chrome 149 and Chrome 150 successfully fixed a total of 1072 vulnerabilities. The graph below shows the number of vulnerabilities fixed for each Chrome version.
◆Release a corrected version of Chrome
The corrected version of Chrome needs to be rolled out as soon as possible. Therefore, Google
◆Users will have the updated Chrome installed.
Chrome applies updates when it's restarted, but some users leave the browser open for extended periods. Google is reportedly working on a mechanism to apply updates without restarting Chrome. They are also trying to increase the amount of data stored locally so that sessions can be resumed from where they left off after a restart.
Furthermore, macOS addresses OS-specific issues. In Windows, closing a window terminates the application, but in macOS, 'closing a window' and 'quitting an application' are different actions, and Chrome cannot be closed until the user selects 'Quit' from the menu or presses the 'Command + Q' shortcut key. Therefore, in the macOS version of Chrome 150, it has been changed to automatically restart and apply the update when the window is closed.
Google points out that not only finding and fixing bugs, but also rapidly deploying those fixes is a crucial aspect of defense in the age of AI.
Related Posts:
