AI is finding so many Chrome security flaws that Google may start updating it twice a week

[Skye Jacobs]

Forward-looking: Google is speeding up Chrome's update cycle as AI tools uncover a growing number of security flaws in the browser's code. Chrome versions 149 and 150, released within weeks of each other, carried a combined 1,072 bug fixes, more than the previous 23 versions delivered combined, reflecting how quickly AI-driven analysis is surfacing issues.

These tools are scanning code at a scale and speed that were not previously possible. In at least one case, the technology exposed a flaw that had remained in Chrome for 13 years. If exploited, the bug could have allowed attackers to bypass the browser's sandbox protections and access local files.

The rapid pace of discovery is forcing Google to rethink how it delivers updates. The company has already shortened its release cycle to every two weeks, but it is now testing an even faster model that could push updates out twice a week. The goal is to reduce the time between identifying a vulnerability and getting a fix into users' hands.

The same AI capabilities helping Google find bugs could also be used by attackers to locate weaknesses just as quickly. Faster patching is one way to limit that risk.

But releasing updates more often creates another problem: users do not always install them right away. Chrome typically downloads updates in the background, but it still depends on a browser restart to complete installation. Many users delay that step, leaving systems exposed longer than intended.

Google is starting to address that issue. In Chrome 150 on macOS, the browser can now update itself when all windows are closed, but the app is still running in the background. The company calls this a "zero window restart." When the user opens Chrome again, the update has already been applied, avoiding the need for a manual restart in many cases.

Google is also working on a more advanced approach known as "dynamic patching." This would allow updates to be applied without any restart at all. Google has not provided details on when that capability might be ready, but it says it is continuing to invest in the effort.

The increase in AI-driven vulnerability detection is unlikely to slow down. As those tools become more capable, the pressure to respond quickly will only grow, which may be why Google is moving to a different model for browser security. Rather than relying on periodic updates that require user action, Chrome is moving toward a system in which fixes are delivered continuously and with little or no disruption.

Permalink to story:

AI is finding so many Chrome security flaws that Google may start updating it twice a week

 

[ScottSoapbox]

Twice a week is silly.

There are a finite amount of bugs to discover, so you will quickly patch most of them and drop back to fewer discoveries - assuming your new code isn’t crap so focus on that instead of constant patches.

 

[winjer]

One would expect that hackers are also using AI to find and exploit some of these bugs as well.
So it's a race to see who can patch or exploit any given bug, before the other.

 

[GeoffreyA]

I think at some point, it will start to trail off, once the low-hanging fruit is caught.

 

[MiqWalsh]

The update model for Linux Chrome has always been 'sketchy'. Google provide the updates via a local cron job, but the majority of distros disable this ability in favour of reviewing everything first & then pushing them out via the standard repo update cycle.

The provided updater never did work for us in 'Puppy' Linux, so I wrote us a new one for the 'portable' Chrome build I provide for the community. This checks for updates at launch; if a new one exists (comparing with the installed version file in your profile), the user is given the option to update there & then. The update is downloaded via wget & installed, then the browser immediately launches with the updated version straight away.

This whole process takes less than 2 minutes. Nobody is in such a hurry that they can't afford to wait that short a time.

The user is also given the option to skip the update if so desired. Any negative side-effects are thus due to the user's personal decision......and the update will be offered once again at next launch.

 

[human7]

As long as the bugs are found en masse, I suspect most software vendors will need to think about consumer side updates as part of the CI/CD pipeline (just an asynchronous and distributed side to it).

 

[pexxie]

Imagine if excessive memory consumption was considered a security flaw.

 

[SRB]

The bigger question is how many of these 1072 bugs are a either exploitable, show stopping, or trivial (formatting, broken calls, etc.) While all bugs are bad, if they are not compromising or dangerous, I would think that the vast majority are more irritating and harmless.

Which begs the question, if AI can find bugs this efficiently, why is it that so much AI generated code is bug ridden?

 

[pnntmp]

OK, AI is making everything far more secure, no surprise here.
I'm amazed to see an 'AI is so helpful' article on this website, which core tenet seems to be 'AI bad'.

 

[MaestroIT]

I use Opus 5.0 on High thinking Effort to scan my web apps for security, and it keeps finding things I never noticed; it is helping in making my apps more secure.

What I like is that it thinks way ahead: For example if a user doesn't exist when trying to sign in I used to say immediately as expected "Credentials don't match our system", to keep it ambiguois if user exist or not, but it says giving the message quickly without hashing the password will be a side-channel attack of speed to know the password was not hashed, hash a random password to pass time and then give the error message. I would not have thought of this in my simple apps.

 

[mdenigma]

I wounder were all these bugs came from. After 20 years of outsourcing development to a 2 dollars per day worker in india ... this should have been the perfect code!