Chrome Needs Twice-a-Week Patching Thanks to AI Bug Hunting

Google’s Chrome browser has always been focused on pushing security updates. A decade ago it was controversial that the browser, the first to add automatic updates, distributed patches every six weeks. Now it’s the norm for critical, widely used software to get security fixes every few weeks, but as AI vulnerability hunting produces a torrent of bugs in any and all software, the quantity and frequency of patches is spiking—and the race to deliver them is on.

In a report published Thursday, the Chrome security team says the browser’s two major version releases in June included fixes for 1,072 security bugs—more patches than the team shipped in the prior 23 big releases combined. And though many of these bugs come from researcher submissions, the spike has largely been driven by the Chrome security team’s rapidly evolving internal process for using AI tools in vulnerability discovery, triage, and patch development.

“In chrome we’ve been using machine learning—using AI before it was called AI—to help find vulnerabilities in particular and automate security fuzz testing work since at least 2012. It’s been a huge part of how we find vulnerabilities and empower developers,” Parisa Tabriz, Chrome’s vice president and general manager, tells WIRED. “But I do think this year is very different. It really feels like an inflection point both for offense and defense.”

Chrome is already moving toward a new normal of pushing out a major release every two weeks with additional weekly security updates. But the frenzy of vulnerability discoveries has been so intense, and the team has had so much success incorporating new AI models and capabilities into the workflow of finding and fixing new bugs, that for now the group is piloting a cadence of releasing security fixes twice a week.

“The way we ended up here is we had so many vulnerability fixes, so being able to provide two [updates per week] during this time, it made the most sense to us,” says Doug Turner, Chrome’s director of engineering. “Will that last forever? Who knows.”

Turner, like other security researchers, says he sees evidence that the AI vulnerability boom time (or apocalypse, depending on how you look at it) may not last forever. For mature, stable products like Chrome, at least, there seems to be a drop off at a certain point in the number of new vulnerabilities that will be discovered overtime once the bulk of bugs that can be found with AI have been fixed. This is partly because AI models can be trained to have an encyclopedic understanding of how software projects have evolved over time.

“We’re training our model such that it knows about every security vulnerability that we have seen in the past,” Turner says. “So every CVE, every bug the model knows about. And the second really cool thing is every line of code in Chromium’s history, it knows the reason why that line was changed.”

All of this context allows AI tools to home in on possible weaknesses across Chrome’s massive and complex codebase, including for features (say, printing) that are no longer under active development and may not attract as many human eyes anymore.

Tabriz and Turner emphasize, too, that in addition to whack-a-mole patching, the Chrome security team is also extremely focused on the idea of making structural changes to how the browser is designed (such as rewriting portions of C++ code in the more secure, “memory safe” programming language Rust) so the software is no longer affected by whole categories of common bugs.

“There’s this near-term spike, but I do think there’s going to be a new equilibrium,” Tabriz says. “Across the industry I think it’s really important that people who are building and thinking about software security are incorporating AI into their development workflows. My highest hope is that everything gets more secure. But I don’t assume everything is going to just get better. I don’t think it’s going to come for free.”