Chrome is now patching security holes twice a week, and AI found most of them

Key points

• Google's Chrome browser shipped fixes for 1,072 security bugs across its two major releases in June 2025, more than the previous 23 major releases put together.
• Chrome's security team now releases patches twice a week, up from the previous rhythm of one major update every two weeks.
• The spike is driven largely by AI tools that Chrome's own engineers use to find, sort, and fix vulnerabilities inside the browser's code.
• Google trains its AI models on every past Chrome security flaw and every line of code in the browser's history, helping it spot patterns humans would miss.
• Chrome's VP Parisa Tabriz told Wired AI this year feels like "an inflection point both for offense and defense."

Google shipped fixes for 1,072 security bugs in Chrome's two June releases. That is more patches than the team pushed out across the previous 23 major releases combined. The browser is now sending updates twice every week.

The reason is AI, applied from the inside.

What is Chrome's team actually doing?

Chrome's engineers are using AI tools to find weaknesses in the browser's own code, prioritise which ones matter most, and help write the fixes. This is not a new idea for Google: Chrome's VP and general manager Parisa Tabriz told Wired AI the team has used machine-learning tools for security testing since at least 2012. But she called 2025 "very different" and an "inflection point."

A key part of the approach is what the team teaches its models. Doug Turner, Chrome's director of engineering, says the AI knows every CVE (a CVE is an officially numbered record of a known security flaw) Chrome has ever had, plus the full history of why every line of code in the browser was ever changed. That context lets the AI home in on corners of the codebase that human reviewers rarely visit, including features like printing that are no longer under active development.

Should Chrome users be worried about all these bugs?

Not especially. Finding and fixing bugs quickly is the good outcome. The concern would be bugs found by attackers first.

Turner also sees early signs that the current frenzy will not last. Once AI tools sweep through a mature codebase and the bulk of hidden flaws are fixed, the discovery rate should fall. There is a ceiling to how many vulnerabilities any given piece of software contains.

Beyond patching individual flaws, the Chrome team is rewriting portions of the browser in Rust, a programming language that eliminates whole categories of memory-related bugs that have plagued software for decades. That is the structural fix, not just the whack-a-mole work.

"There's this near-term spike, but I do think there's going to be a new equilibrium," Tabriz said.

What does this mean for the rest of the software industry?

Chrome is one data point, but the same AI scanning tools are available to anyone building software, and to attackers looking for flaws to exploit. The race is real. Tabriz put it plainly: getting more secure will not come for free, and teams that are not using AI in their security workflows are already behind.

What to watch for: Your Chrome browser updates itself automatically, so no action is needed on most devices. If you have ever turned off automatic updates, now is a good time to re-enable them. Go to Chrome's settings, select "About Chrome," and let it check for the latest version.