# Chrome Security Update AI: 1,072 Bugs, Then 1,442

> Google says AI fixed 1,072 Chrome bugs. Chrome 151 added 370 and Chrome 152 added 327. What the counts mean and why to restart your browser.

Canonical: https://www.nihardaily.com/posts/chrome-security-update-ai-1072-bugs-then-1442
Last updated: 2026-10-14

- Published: 2026-08-02
- Author: Nihar Ranjan Das
- Reading time: 5 min
- Categories: Software
- Tags: chrome, browser security, google gemini, vulnerability management, ai security, software updates

## Key takeaways

- Google fixed 1,072 security bugs across Chrome 149 and 150. Chrome 151 added 370, making 1,442, and Chrome 152 added 327 more.
- In Chrome 151, 349 of 370 fixes came from Google's own tooling. Reports say it also patched CVE-2026-11645, a V8 flaw already on CISA's exploited list.
- Keep automatic updates on and restart Chrome when an update is waiting. The patch applies only after a restart.

Google says AI helped it fix 1,072 Chrome security bugs across two releases. That number was already out of date when it was announced. Chrome 151 added 370 more, which makes 1,442. Chrome 152 then fixed 327 more, so four releases have now produced 1,769 security fixes by simple addition.

The count is real, but the more useful questions are what it means and what you should do. This post is updated for October 14, 2026, with the releases that landed since August.

## The numbers, with sources

Different headlines use different totals because they count different releases.

| Release | Security fixes | Notes |
| --- | --- | --- |
| Chrome 149 and 150 combined | 1,072 | Google's figure; more than the prior 23 milestones together |
| Chrome 151 (July 29, 2026) | 370 | 349 found by Google's own tooling, 7 critical |
| Chrome 149 to 151 | 1,442 | 1,072 plus 370 |
| Chrome 152 (late August 2026) | 327 | 10 critical, 61 high, 184 medium, 72 low, per press reports |
| Chrome 149 to 152 | 1,769 | My sum of the above |

The 1,072 figure comes from Google's own post, reported by [BleepingComputer](https://www.bleepingcomputer.com/news/google/google-says-ai-helped-chrome-fix-1-072-security-bugs-in-two-releases/amp/) and others. One report puts the previous 23 milestones at 1,036 fixes, so the two-release total beat them by a small margin. The Chrome 151 and 152 figures come from secondary coverage of Google's release notes. I could not read the full Chrome Releases post for either version, so check chromereleases.googleblog.com before quoting an exact count.

## What changed since August: an exploited bug

The most important detail in the Chrome 151 coverage is not the count. Reports say the release patched CVE-2026-11645, a V8 out-of-bounds flaw that was already on the CISA Known Exploited Vulnerabilities list before the update shipped. If that is right, attackers were using it in the wild.

That is a different category from a quiet backlog being cleared. It is also the case for not postponing browser restarts. This came from a single secondary source, so confirm it in the Chrome 151 release notes or the CISA catalogue.

For Chrome 152, press reports say Google had not confirmed active exploitation of any patched issue. Its headline fix was CVE-2026-79282, a use-after-free in ANGLE, the graphics layer, which earned a $25,000 bounty.

## What "AI across the pipeline" means at Google

Google is not using one model to write patches and calling it done. According to the coverage of its post, Gemini now touches several stages of Chrome's vulnerability work:

- **Finding bugs.** In early 2026 Google built a Gemini-powered agent harness that searches the Chrome codebase for vulnerabilities while cutting false positives. It runs several passes, because model output is unpredictable, and it draws on a knowledge base built from Chrome's full Git history.
- **Triage.** Automated agents filter duplicates, reproduce the bug, assign severity and route it to the right team.
- **Fixing.** Agents draft candidate patches, act as critics of each other, and write cross-platform tests.

One find stands out: a sandbox escape that would let a compromised renderer trick the browser into reading local files. It had been in the codebase for more than 13 years.

Android Authority also reported that Google is piloting two security releases a week and "dynamic patching" for critical background updates. That is not confirmed in Google's own post as far as I can tell.

## Two readings of the same data

The tension in Google's announcement is that two readings both fit.

**Reading one: Chrome got safer.** Bugs that sat unpatched for months are now caught earlier. Faster reproduction and severity scoring gets critical bugs fixed sooner, which is the metric that shrinks the exploit window. A bug Google finds itself is one nobody outside Google can weaponize first.

**Reading two: the bug supply looks close to endless once AI does the searching.** A browser with tens of millions of lines of C++ always had more latent bugs than human review could find. Gemini did not shrink that population. It got much better at sampling it. If attackers use similar AI-assisted fuzzing, and there is no reason to assume they cannot, the race sped up for both sides.

The next release proved the point. Chrome 151 fixed 370 after the first 1,072, and Chrome 152 fixed 327. The count did not settle toward zero. It would if AI were only clearing a fixed backlog. Fix counts that stay high after several releases suggest the supply is large.

## The number to watch

A high fix count used to be a red flag. In an AI-assisted pipeline, it may simply reflect better bug-hunting against a codebase whose latent bug population was always larger than anyone could see.

The metric worth tracking is how much of the count the vendor found itself before outsiders did. In Chrome 151, 349 of 370 came from Google's own tooling, about 94%. That says more about defensive progress than the headline total. Add one more metric: how many bugs were already being exploited when the patch shipped.

## What you should do

The practical advice has not changed, and the reasons are stronger now.

1. Keep Chrome on automatic updates.
2. Restart the browser when an update is waiting. The patch only applies after a restart.
3. Check **Settings, About Chrome** to confirm your version, especially on machines that run for weeks.
4. Apply the same rule to every Chromium-based browser, such as Edge, Brave and Opera. They pull fixes from the same code, and each ships on its own schedule.

For IT teams, the lesson is to shorten your patch window for browsers. Critical bugs are the ones attackers chain into remote code execution with little extra work.

## Automation cuts both ways

Automated tooling does not only help defenders. The [keyv npm supply chain attack](https://www.nihardaily.com/posts/how-the-keyv-npm-attack-reached-vs-code-and-claude-code) poisoned hundreds of packages in roughly half an hour. That is the same speed advantage Google is buying for itself, aimed the other way. Speed helps only when the judgment driving it is sound.


## FAQ

### Is 1,072 the number of Chrome bugs fixed by AI?

Not exactly. It covers fixes across Chrome 149 and 150. Google says Gemini helped across discovery, triage and patching, not that AI alone fixed all of them.

### Why do some reports say 1,442 instead of 1,072?

1,442 adds Chrome 151's 370 fixes to the 1,072 from Chrome 149 and 150.

### Does a high fix count mean Chrome is less secure?

Not necessarily. It can reflect better detection. Watch the share found by the vendor itself and how many bugs were exploited before the patch.

### How do I update Chrome?

Open Settings, then About Chrome, let it download the update and click Relaunch. Keep automatic updates on.

## Related

- [Nihar Ranjan Das](https://www.nihardaily.com/author/nihar-ranjan-das)
- [AI coding tools hid 15 GB on my Mac. unclog found it](https://www.nihardaily.com/posts/ai-coding-tools-hid-15-gb-on-my-mac-unclog-found-it)
- [Laravel's RateLimited job middleware failed 240 of 300 jobs](https://www.nihardaily.com/posts/laravels-ratelimited-job-middleware-failed-240-of-300-jobs)
- [Cashier locks customers out on day 0 of the retry window](https://www.nihardaily.com/posts/cashier-locks-customers-out-on-day-0-of-the-retry-window)