Google's Chrome Security Team has unveiled a comprehensive overhaul of its vulnerability management pipeline, heavily relying on AI to expedite bug detection, assessment, and patch implementation as attackers increasingly leverage large language models (LLMs) for automated exploit development. The team’s AI security journey began in 2023 with LLM-assisted fuzzing, followed by Project Zero's Naptime in 2024 and Big Sleep in 2025, which identified real bugs in the V8 engine and Chrome's graphics stack. In early 2026, Google deployed a Gemini-powered agent across its full Chrome codebase, uncovering a sandbox escape (tracked as crbug.com/487383169) that had gone undetected for over 13 years.
Chrome’s new pipeline automates the process through four phases: filtering spam and duplicates, reproducing bugs with stack trace generation, enriching reports with severity metadata, and routing issues to the appropriate developer. Google claims this saves hundreds of developer hours every month. To counteract "N-day" attacks where hackers exploit public fixes before patches are released to users, Chrome is piloting two security releases per week as part of its broader shift towards a bi-weekly major release schedule.
Chrome aims for comprehensive memory safety improvements by expanding MiraclePtr and MiracleObject to neutralize up to 90% of use-after-free bugs on the GPU main thread, while a "spanification" effort has brought 97% of first-party code into strict unsafe-buffer warnings.
