Chrome Fixes 1,442 Bugs in Three Releases Amid AI-Driven Vulnerability Surge
Google has fixed an extraordinary 1,442 security vulnerabilities across Chrome versions 149, 150, and 151—more than the combined total of the prior 23 milestones. Chrome 149 and 150 alone, both released last month, addressed 1,072 bugs, while version 151, rolled out Wednesday, patched an additional 370 flaws, 349 of which were discovered internally by Google. Seven of those issues are rated critical in severity.
The surge is being driven largely by large language models accelerating bug discovery. According to the U.S. National Vulnerability Database (NVD), 46,872 flaws have been logged in 2026 so far, nearly matching the 49,920 reported for all of 2025. One standout is CVE-2026-3545, a critical sandbox-escape vulnerability in Chrome's Navigation component (CVSS 9.6) that could trick the browser into reading local files from a user's system. Google said the flaw sat undetected in the codebase for more than 13 years before being uncovered by an AI agent harness built on its Gemini models—a striking example of LLM-powered vulnerability research reshaping the threat landscape.
In response, Google is accelerating its release cadence, piloting two security updates per week to counter what it calls "fast-moving, AI-powered attacks." The company is also automating CVE descriptions and release notes to shrink the window between discovery and public disclosure, and is experimenting with dynamic, restart-free patching that swaps background child processes on the fly using Chrome's multi-process architecture. A macOS-specific change shipped in Chrome 150 already exploits the OS tendency to keep apps running after windows close, allowing pending updates to apply without user interruption.
For everyday users, this wave of disclosures is a reminder to keep browsers updated and to periodically verify that credentials and session data haven't been exposed. Running a quick privacy checkup can surface risky browser settings, while a password checker helps confirm that stored logins haven't surfaced in known breach dumps. Organizations should also audit exposed services with the port scanner to ensure no Chrome-adjacent management endpoints are inadvertently reachable from the public internet.