Google AI Discovers 13-Year-Old Chrome Vulnerability Amid Record Patching Speed

Post Views: 1

Google has revealed the discovery of a long-standing security vulnerability in the Chrome browser, traced back 13 years, as part of an accelerated effort to address emerging threats.

Overview of the Vulnerability

The flaw, identified through advanced artificial intelligence tools, was resolved in May 2026 as part of Chrome 145. This finding highlights the growing role of machine learning in identifying and mitigating critical security risks.

Security Patches and AI Integration

Google reported that the number of vulnerabilities addressed in Chrome has reached unprecedented levels this year, with over 1,800 fixes implemented since April. The latest browser update included 370 security patches, marking a significant increase compared to previous release cycles.

Vulnerability Details

The vulnerability, designated CVE-2026-3545 with a CVSS score of 9.8, stemmed from inadequate data validation within the browser’s navigation module. It could have allowed malicious actors to exploit crafted HTML pages to bypass the browser’s sandboxing mechanisms, enabling unauthorized access to local files.

AI-Powered Security Initiatives

Google emphasized that the flaw remained undetected for over a decade before being uncovered by its AI-driven security initiatives. The company attributed the rapid identification of this and other vulnerabilities to the deployment of an AI-powered agent harness, which leverages the Gemini model to analyze Chrome’s codebase more efficiently.

Agent Harness Functionality

The agent harness, developed in early 2026, is designed to streamline vulnerability detection by integrating with existing security workflows. It supports model interoperability, draws from a knowledge base of historical CVEs, and utilizes Chrome’s full Git history to contextualize potential risks.

Collaborative Review Process

The system incorporates developer-provided SECURITY.md files, which are reviewed by a “critic” agent to refine findings. This approach enables repeated scans of the codebase using specialized models, enhancing the accuracy of threat detection.

Security Release Strategies

Google noted that all AI operations are conducted in isolated environments without internet access, ensuring compliance with safety protocols. Beyond AI-driven discovery, the company has implemented broader strategies to reduce the time between vulnerability identification and public disclosure.

New Release Schedule

A new twice-weekly security release schedule is being tested to complement the existing two-week cycle for major updates. Automated tools are also being developed to generate release notes and CVE descriptions, minimizing manual bottlenecks.

Dynamic Patching and Memory Safety

To further improve user protection, Chrome is adopting dynamic patching techniques that allow updates to be applied without restarting the browser, maintaining session continuity even during maintenance. Google is also targeting fundamental security weaknesses in its codebase, particularly memory safety flaws.

Memory Safety Improvements

Efforts include hardening runtime environments to mitigate C++-related vulnerabilities and transitioning to memory-safe programming languages. The company is expanding the use of MiraclePtr, a tool designed to prevent use-after-free errors, and deploying MiracleObject to the GPU main thread.

Long-Term Plans

Additional measures include “spanification” to eliminate out-of-bounds access risks and enhanced protections against integer overflows. Long-term plans involve replacing critical components with Rust, a language engineered to reduce memory-related vulnerabilities.

Collaboration and Future Goals

In parallel, Google is exploring the integration of HTML, CSS, and TypeScript for the browser’s user interface to reduce reliance on traditional C++ frameworks. The company also emphasized the importance of securing the open-source ecosystem, implementing automated pipelines to monitor and update third-party dependencies.

“Every fixed bug represents a critical barrier against potential attacks,” the company stated. “Our focus remains on deploying fixes faster than adversaries can exploit them, while investing in systemic solutions to eliminate entire categories of vulnerabilities.”