Three Recent Chrome Releases Fix 1,442 Flaws, More Than Prior 23 Updates Combined

Summary

Google has released three recent Chrome updates (versions 149, 150, and 151) that collectively patched 1,442 security vulnerabilities, a number exceeding the total from the previous 23 updates combined. This surge in vulnerability discovery is partly attributed to the use of AI, like Google's Gemini models, in finding bugs, including a critical sandbox escape (CVE-2026-3545). Google is accelerating its patching cadence and exploring dynamic patching to address the increasing rate of AI-powered attacks.

Full text

Three Recent Chrome Releases Fix 1,442 Flaws, More Than Prior 23 Updates Combined Ravie LakshmananJul 31, 2026Vulnerability / Browser Security Google on Thursday announced that it fixed a whopping 1,072 security bugs in Chrome versions 149 and 150, surpassing the total number of flaws the company fixed across the prior 23 milestones combined. Both versions were released last month. In its latest patch for Chrome 151, released Wednesday, the tech giant resolved 370 flaws, out of which 349 were reported by Google itself. Seven of the vulnerabilities have been marked critical in severity. The development comes amid an exponential surge in vulnerability discovery, mainly fueled by the advent of large language models (LLMs) that have accelerated the process, leading to an unprecedented spike in new bug reports, so much so that issues are being flagged at a faster rate than companies can fix them. According to statistics shared by the U.S. National Vulnerabilities Database (NVD), 46,872 flaws have been recorded so far in 2026, nearing the 49,920 vulnerabilities reported for the entirety of 2025. One such vulnerability discovered in the Chrome codebase is a critical sandbox escape in the Navigation component (CVE-2026-3545, CVSS score: 9.6) that could be exploited to trick the browser into reading local files from the user's system. It was patched by Google earlier this March. The shortcoming, per Google, was discovered via an agent harness leveraging its Gemini models and remained undetected in its source code for more than 13 years. The tech giant, which is in the process of transitioning to a two-week release cadence for major Chrome milestones, alongside weekly security updates, said it's piloting a shift to two security releases per week in the face of "fast-moving, AI-powered attacks." "Even with this pace, proper public disclosure remains paramount," Google said in a post. "Every security bug that reaches Chrome Stable, regardless of whether it was discovered internally or reported externally, is documented and disclosed publicly as a standard best practice." Google said it's working on automating efforts to generate release notes and CVE descriptions from security bug fixes to mitigate manual bottlenecks and further shorten the window between vulnerability discovery and public disclosure. Separately, the internet behemoth noted it's exploring ways to dynamically apply the patches without the need for restarting Chrome and ensure a seamless session restore in situations where a restart is required for the changes to take effect, thus eliminating delays and shifting the burden away from the end users. "By leveraging Chrome's multi-process architecture, dynamic patching sequentially replaces background child processes (like the Renderer and GPU) with updated binaries on the fly," Google said. "For example, in Chrome 150, we rolled out a change to take advantage of the unique application state on macOS where applications typically continue running in the background even after all windows are closed. Now, if Chrome detects a pending update while in this windowless state, it automatically restarts." Additionally, Google is taking steps to eliminate entire classes of security issues from Chrome, such as use-after-frees, out-of-bounds weaknesses, and memory safety flaws, by hardening the runtime environment to combat legacy C++ flaws, transitioning to memory-safe languages like Rust, and implementing the browser's top-level user interface using HTML, CSS, and TypeScript to further reduce dependencies on traditional C++ frameworks. That's not all. In an attempt to improve browser security, the company said it's moving all Chrome third-party dependencies onto automated update pipelines to ensure they are up-to-date. "Every bug found and fixed is one less foothold for an attacker," Google's Chrome Security Team said. "But discovering and fixing a bug is only half the battle - we must also ship the fix and apply the update for users faster than adversaries can exploit the bug, and invest in projects that mitigate or eliminate classes of bugs through accelerated release cadences, dynamic patching, and opportune restarts, we are driving toward a browser that is continuously protected without disrupting the user." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Application Security, artificial intelligence, browser security, cybersecurity, endpoint security, MacOS, Patch Management, Software Security, Vulnerability ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders

Indicators of Compromise

• cve — CVE-2026-3545

Entities