Gemini agent digs a 13-year-old sandbox escape out of Chrome's code
Google announced Thursday that its AI tools helped to fix 1,072 security bugs across the two versions of Chrome it shipped in June. That’s more than the previous 23 releases of the browser combined.
One of those tools also found a sandbox vulnerability that had been hiding in the code for over 13 years.
Google’s AI found a Chrome sandbox bug hidden since 2013
The count of 1,072 includes Chrome 149 and Chrome 150, both released last month. The 23 stable releases Google has shipped over the last two years contained a total of 1,036 fixes.
Large language models have “fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation,” said Doug Turner, Chrome’s director of engineering. Models like Gemini allow the team to “preemptively” fix flaws and get ahead of attackers, he said.
The company said that “an increase in bugs found and fixed is not a sign of failure.”
In early 2026, Google built a Gemini agent harness to sift through the wider Chrome codebase. That system found a sandbox escape that was in the code for over 13 years. The flaw, if unpatched, could allow a compromised renderer process to trick the browser into reading local files, Google said.
Google has been running LLMs against its own security work for years, beginning with fuzzing coverage in 2023 and then the Naptime tooling with Project Zero in 2024. DeepMind and Project Zero arrived with the Big Sleep discovery agent, discovering bugs in the V8 JavaScript engine and graphics stack in 2025.
The 2026 harness added interoperable open-weight and proprietary models, a knowledge base built from Chrome’s Git history and previous CVEs, and a “critic” agent that scans developer-written SECURITY.md files to learn where trust boundaries are located.
Machines now triage and patch Chrome bugs
Google is also training AI to validate, sort, and repair the reports that come in. Triaging a single security report used to take five to more than 30 minutes of human attention. Now, a hybrid pipeline of rules and models filters out spam and duplicates, reproduces bugs on the affected operating system and Chrome version, attaches metadata like severity and when the bug was introduced, and routes it to an owner.
Google estimates the change saves hundreds of developer hours each month.
It runs a fixing agent for repairs, which proposes several candidate patches, and a second critic agent, which picks the strongest candidate, looping the way a code review would until the change compiles and meets Chromium style rules. The system also writes tests prior to an engineer signing off.
The models read source code on locked-down machines that have no general internet access, run behind an allowlisted network interception, and are not permitted to touch files outside designated source directories.
Google is working to narrow the “patch gap,” the time between when a fix appears in public source code and when users actually apply it. Attackers have that window to study a patch and develop an exploit. Google is trialing two security releases a week and is working on dynamic patching that would allow bits of Chrome to be updated without a full restart.
The surge also changed Google’s bug bounty. External submissions grew so quickly that by March, the company had more reports than all of 2025 combined, prompting it to revamp the Chrome Vulnerability Reward Program to steer researchers toward bugs its tools are less likely to find.
In the longer term, Google is expanding its MiraclePtr memory-safety tool, converting new components to Rust, and donating $12.5 million to the Alpha-Omega open-source security project.
Microsoft’s recent Patch Tuesday, which patched a record 570 flaws, included mention of AI, but Apple, with an independent count of 482 fixes in 2026, is not on the same curve.
If you're reading this, you’re already ahead. Stay there with our newsletter.
Recommended Articles
