AI is finding so many Chrome security flaws that Google may start updating it twice a week

[Skye Jacobs]

Forward-looking: Google is speeding up Chrome's update cycle as AI tools uncover a growing number of security flaws in the browser's code. Chrome versions 149 and 150, released within weeks of each other, carried a combined 1,072 bug fixes, more than the previous 23 versions delivered combined, reflecting how quickly AI-driven analysis is surfacing issues.

These tools are scanning code at a scale and speed that were not previously possible. In at least one case, the technology exposed a flaw that had remained in Chrome for 13 years. If exploited, the bug could have allowed attackers to bypass the browser's sandbox protections and access local files.

The rapid pace of discovery is forcing Google to rethink how it delivers updates. The company has already shortened its release cycle to every two weeks, but it is now testing an even faster model that could push updates out twice a week. The goal is to reduce the time between identifying a vulnerability and getting a fix into users' hands.

The same AI capabilities helping Google find bugs could also be used by attackers to locate weaknesses just as quickly. Faster patching is one way to limit that risk.

But releasing updates more often creates another problem: users do not always install them right away. Chrome typically downloads updates in the background, but it still depends on a browser restart to complete installation. Many users delay that step, leaving systems exposed longer than intended.

Google is starting to address that issue. In Chrome 150 on macOS, the browser can now update itself when all windows are closed, but the app is still running in the background. The company calls this a "zero window restart." When the user opens Chrome again, the update has already been applied, avoiding the need for a manual restart in many cases.

Google is also working on a more advanced approach known as "dynamic patching." This would allow updates to be applied without any restart at all. Google has not provided details on when that capability might be ready, but it says it is continuing to invest in the effort.

The increase in AI-driven vulnerability detection is unlikely to slow down. As those tools become more capable, the pressure to respond quickly will only grow, which may be why Google is moving to a different model for browser security. Rather than relying on periodic updates that require user action, Chrome is moving toward a system in which fixes are delivered continuously and with little or no disruption.

Permalink to story:

AI is finding so many Chrome security flaws that Google may start updating it twice a week

 

[ScottSoapbox]

Twice a week is silly.

There are a finite amount of bugs to discover, so you will quickly patch most of them and drop back to fewer discoveries - assuming your new code isn’t crap so focus on that instead of constant patches.

 

[winjer]

One would expect that hackers are also using AI to find and exploit some of these bugs as well.
So it's a race to see who can patch or exploit any given bug, before the other.

 

[GeoffreyA]

I think at some point, it will start to trail off, once the low-hanging fruit is caught.

 

[MiqWalsh]

The update model for Linux Chrome has always been 'sketchy'. Google provide the updates via a local cron job, but the majority of distros disable this ability in favour of reviewing everything first & then pushing them out via the standard repo update cycle.

The provided updater never did work for us in 'Puppy' Linux, so I wrote us a new one for the 'portable' Chrome build I provide for the community. This checks for updates at launch; if a new one exists (comparing with the installed version file in your profile), the user is given the option to update there & then. The update is downloaded via wget & installed, then the browser immediately launches with the updated version straight away.

This whole process takes less than 2 minutes. Nobody is in such a hurry that they can't afford to wait that short a time.

The user is also given the option to skip the update if so desired. Any negative side-effects are thus due to the user's personal decision......and the update will be offered once again at next launch.

 

[human7]

As long as the bugs are found en masse, I suspect most software vendors will need to think about consumer side updates as part of the CI/CD pipeline (just an asynchronous and distributed side to it).

 

[pexxie]

Imagine if excessive memory consumption was considered a security flaw.

 

[SRB]

The bigger question is how many of these 1072 bugs are a either exploitable, show stopping, or trivial (formatting, broken calls, etc.) While all bugs are bad, if they are not compromising or dangerous, I would think that the vast majority are more irritating and harmless.

Which begs the question, if AI can find bugs this efficiently, why is it that so much AI generated code is bug ridden?

 

[pnntmp]

OK, AI is making everything far more secure, no surprise here.
I'm amazed to see an 'AI is so helpful' article on this website, which core tenet seems to be 'AI bad'.

 

[MaestroIT]

I use Opus 5.0 on High thinking Effort to scan my web apps for security, and it keeps finding things I never noticed; it is helping in making my apps more secure.

What I like is that it thinks way ahead: For example if a user doesn't exist when trying to sign in I used to say immediately as expected "Credentials don't match our system", to keep it ambiguois if user exist or not, but it says giving the message quickly without hashing the password will be a side-channel attack of speed to know the password was not hashed, hash a random password to pass time and then give the error message. I would not have thought of this in my simple apps.

 

[mdenigma]

I wounder were all these bugs came from. After 20 years of outsourcing development to a 2 dollars per day worker in india ... this should have been the perfect code!

 

[Gezzer]

One would expect that hackers are also using AI to find and exploit some of these bugs as well.
So it's a race to see who can patch or exploit any given bug, before the other.

That's the way it's always been. It's just been accelerated thanks to AI.

 

[Endymio]

I wounder were all these bugs came from. After 20 years of outsourcing development to a 2 dollars per day worker in india ... this should have been the perfect code!

Google's Chromium engine was developed out of their Ontario office, so if you have to blame someone, blame the loons.

 

[BobHome]

Is this the same AI that is dominating and hallucinating our search results? <scarry!>

 

[p51d007]

Can't wait for the day that AI INJECTS a bug in the software, which is released, and screws everything up. You know it is bound to happen.

 

[Mr Majestyk]

Wake me when we get daily updates. Twice weekly is so passe.

 

[Northy]

With every patch the attack surface grows, so there will be bugs discovered in bugs in bugs... until in the near future it gets like Adobe Reader where you have a 2GB updates on the regular, and it doesn't really work that good anymore.

 

[Theinsanegamer]

With every patch the attack surface grows, so there will be bugs discovered in bugs in bugs... until in the near future it gets like Adobe Reader where you have a 2GB pdf reader install, and it doesn't really work that good anymore.

The same thing would happen without AI, just slower. That assumes, of course, that none of these patches can just outright replace previous code, or that AI is never used to optimize code and remove excess code.

 

[Northy]

The same thing would happen without AI, just slower. That assumes, of course, that none of these patches can just outright replace previous code, or that AI is never used to optimize code and remove excess code.

I see a sea of endless sprawling shltcode happening long before the money makers decide to make things better, rather than just making more.

 

[Theinsanegamer]

I see a sea of endless sprawling shltcode happening long before the money makers decide to make things better, rather than just making more.

Yes, which is why AI is finding so many bugs and flaws in this code.

 

[hahahanoobs]

Some of these models are really good at debugging too. It's a great technology.

More bugs squashed faster means more human hands on things like features, usability and optimizations.

 

[Liljonny11]

They haven't realized yet that AI can create bugs by "fixing" them. It'll report 1000 bugs fixed and then when one developer didn't check what the AI did or test it, the whole thing blows up. At most tech companies, that new "thousand bug fix" windows update failed to install in over 50% of installations. And after those installations 100% of the servers began to experience issues. They broke WAAAY more then they fixed. And it's hilarious that they are victory lapping after we have had to work double overtime to fix it.

 

[BadThad]

Bugs or just poor coding from start?

 

[jdrch]

> users do not always install them right away

RIP IT departments that restrict or block 3rd party updates.

 

[shimroot]

The bigger question is how many of these 1072 bugs are a either exploitable, show stopping, or trivial (formatting, broken calls, etc.) While all bugs are bad, if they are not compromising or dangerous, I would think that the vast majority are more irritating and harmless.

Which begs the question, if AI can find bugs this efficiently, why is it that so much AI generated code is bug ridden?

Because AI was trained on [checks notes] code written by humans that was already full of bugs.