Breakthrough AI application: Google discovers 13-year-old Chrome vulnerability and sets new patching record

The browser security race enters a new chapter as artificial intelligence (AI) officially joins the vulnerability hunting process. Google recently confirmed that its AI implementation has achieved record-breaking patch delivery speeds, even discovering a critical vulnerability that had remained hidden for 13 years within the Chrome codebase.

A massive leap in AI-driven vulnerability resolution

This year, the number of vulnerabilities discovered and remediated in the Chrome browser surged dramatically, particularly between April and July. The latest version of Chrome recorded 370 security patches, driving the total number of bugs resolved since the beginning of the year to over 1,800.

www.ipsip.vn

How AI just helped Microsoft smash its security patch record

Recently, Microsoft marked a significant milestone by releasing an unprecedented number of security patches for familiar products like Windows and Office.

Notably, Chrome versions 149 and 150 alone resolved up to 1,072 security vulnerabilities. This impressive figure surpasses the combined total of security fixes across the previous 23 version milestones.

Powering this success is an agent orchestration framework leveraging Google's Gemini AI model. This system scans the entire Chrome codebase for security weaknesses with unprecedented efficiency.

Unearthing a 13-year-old vulnerability with an AI assistant

The most compelling proof of AI's capability is the discovery of a dangerous sandbox escape bug that existed undetected for 13 years.

• Sandbox: A secure, isolated environment designed to prevent malware from impacting the host computer system.

• Sandbox escape: An exploit that bypasses this protective barrier to compromise the underlying system.

www.ipsip.vn

A critical flaw: Is Claude AI's sharing feature secretly exposing your information?

An incident involving Claude AI's link-sharing feature exposed a vast number of private user conversations publicly on search engines. This event has sparked concern across the tech community and served as a warning about data security risks when interacting with artificial intelligence.

Tracked as CVE-2026-3545 with a critical CVSS score of 9.8, the vulnerability stems from incomplete data validation in the browser's Navigation component. If exploited via specially crafted HTML pages, this flaw could allow a compromised renderer to trick the browser into reading local files on the user's computer. This severe vulnerability was patched in early May in Chrome version 145.

While the Chrome Security team began exploring large language models (LLMs) in 2023, the real turning point arrived in early 2026 with the maturity of the agent orchestration framework. This system enables multiple AI models to interact with one another, operating on a knowledge base of previously known vulnerabilities and the entire Chrome Git history. In operation, the system utilizes security documentation (SECURITY.md files) provided by developers, which is processed by a "critic agent," while running source code scanning models in continuous iterations.

To ensure absolute safety, Google established strict guardrails to prevent the AI from acting unpredictably. The AI only performs static analysis on the source code, operating entirely within air-gapped systems disconnected from the public internet.

Optimizing the patching pipeline and proactive risk mitigation

In addition to deploying AI to discover, triage, and automatically generate recommended patches for most vulnerabilities, Google maintains its traditional security testing infrastructure. Concurrently, the company continues to incentivize independent researchers to submit findings through its Vulnerability Reward Program (Bug Bounty).

Moving beyond merely fixing existing bugs, AI is also applied to prevent new vulnerabilities at code submit-time. The system neutralizes latent risks within the source code repository tree that would typically be highly elusive if the code snippet were analyzed in isolation.

To shrink the window between vulnerability discovery and public disclosure (the patch gap), Google is testing a twice-a-week security patch release cycle, supplementing the bi-weekly major milestone update schedule introduced in March. The generation of release notes and CVE descriptions has also been automated to minimize manual overhead.

Crucially, to ensure users always run the most secure version without workflow disruption, Google is rolling out dynamic patching. This feature allows live browser updates without requiring a restart, enabling seamless session restoration or background updates when all browser windows are closed.

Refactoring the codebase for hardened security

Over the long term, Google aims to entirely eliminate certain classes of dangerous flaws, most notably memory safety flaws - vulnerabilities arising from improper computer memory management.

The company is upgrading its runtime environment to mitigate bugs stemming from legacy C++ through specific remedies:

• Expanding the MiraclePtr tool to more libraries.

• Applying MiracleObject to the main graphics processing unit (GPU) thread to block use-after-free vulnerabilities.

• Implementing "spanification" techniques to eliminate out-of-bounds memory vulnerabilities.

• Integrating memory allocation safeguards to prevent integer overflows.

Google's core strategy centers on gradually migrating the Chrome codebase to memory-safe programming languages like Rust. The company has built a centralized Rust SDK, utilizing Rust to replace error-prone legacy code and write new modular components. Additionally, Google is experimenting with building the browser's high-level user interface using HTML, CSS, and TypeScript to reduce reliance on traditional C++ frameworks.

Securing the surrounding open-source ecosystem is another top priority. Google employs automated scanning systems to inspect dependencies (third-party libraries used by the browser) and transitioned all these components to an auto-update mechanism to ensure they are patched in a timely manner.

---

For Google, discovering and fixing bugs is only half the battle. The ultimate goal is to deliver patches to users faster than threat actors can exploit them. By combining advanced AI technologies, accelerated release cycles, dynamic patching, and core architectural enhancements, Google is driving toward a continuously protected Chrome browser that never compromises user experience.