Google has recently released a series of updates for its Chrome browser, addressing a total of 1,442 security vulnerabilities across versions 149, 150, and 151. This number surpasses the combined total of flaws fixed in the previous 23 Chrome updates.
In versions 149 and 150, released last month, Google resolved 1,072 security issues. The latest update, version 151, introduced on Wednesday, addressed an additional 370 vulnerabilities, with seven classified as critical. Notably, 349 of these flaws were identified internally by Google’s security team.
The surge in vulnerability discoveries is largely attributed to advancements in large language models (LLMs), which have accelerated the identification of security issues. This rapid pace has led to vulnerabilities being reported faster than companies can address them. According to the U.S. National Vulnerabilities Database (NVD), 46,872 flaws have been recorded so far in 2026, approaching the 49,920 vulnerabilities reported for the entirety of 2025.
One significant vulnerability addressed in these updates is a critical sandbox escape in the Navigation component (CVE-2026-3545, CVSS score: 9.6). This flaw could have allowed attackers to trick the browser into reading local files from a user’s system. Discovered through an agent harness leveraging Google’s Gemini models, this vulnerability had remained undetected in the source code for over 13 years before being patched in March.
In response to the increasing number of vulnerabilities, Google is transitioning to a two-week release cycle for major Chrome updates, supplemented by weekly security patches. The company is also piloting a shift to two security releases per week to counteract fast-moving, AI-powered attacks. Emphasizing transparency, Google ensures that every security bug reaching the stable version of Chrome is documented and disclosed publicly.
To streamline the update process, Google is working on automating the generation of release notes and CVE descriptions from security bug fixes. This initiative aims to reduce manual bottlenecks and shorten the time between vulnerability discovery and public disclosure.
Additionally, Google is exploring methods to apply patches dynamically without requiring users to restart Chrome. By leveraging Chrome’s multi-process architecture, dynamic patching sequentially replaces background child processes with updated binaries on the fly. For instance, in Chrome 150, a change was implemented to automatically restart the browser when all windows are closed, ensuring updates are applied seamlessly.
To enhance browser security further, Google is focusing on eliminating entire classes of security issues, such as use-after-free and out-of-bounds weaknesses. This effort includes hardening the runtime environment to combat legacy C++ flaws, transitioning to memory-safe languages like Rust, and implementing the browser’s top-level user interface using HTML, CSS, and TypeScript to reduce dependencies on traditional C++ frameworks.
Furthermore, Google is moving all Chrome third-party dependencies onto automated update pipelines to ensure they are up-to-date and secure.
These proactive measures underscore Google’s commitment to maintaining Chrome’s security and reliability. As cyber threats evolve, the company’s focus on rapid updates, transparency, and innovative security practices is crucial in safeguarding users against potential exploits.
