A security flaw that had sat in Chrome’s code for more than 13 years was found with help from AI tools, Google says. The company described its bug-finding and repair process in an engineering post published July 30.
The reported results cover Chrome versions 149 and 150. Google says those two releases fixed 1,072 security bugs, more than the combined total across the previous 23 release milestones. The company did not publish an independent assessment of that comparison.
The tools search source code, reproduce reported problems and suggest possible fixes. Google says the models run on restricted machines without general internet access. A separate “critic” agent reviews candidate patches, and human developers still evaluate changes before they ship. Fuzzing, a method that feeds software many unexpected inputs, remains part of the security process.
The system also helps sort incoming reports and assign them to the right team. Google estimates that automated triage saves hundreds of developer hours a month. That estimate comes from the company, not an external time study.
Finding a bug does not protect users by itself. Developers still need to verify a fix, release it and get it onto people’s devices. Google calls the delay between a public fix and an installed update the “patch gap.” Its post describes one company’s internal process, not a controlled comparison with other browsers.
