Three Recent Chrome Releases Fix 1,442 Flaws, More Than Prior 23 Updates Combined
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Google fixed 1,072 security bugs across Chrome versions 149 and 150, exceeding the combined total of flaws resolved in the browser's prior 23 release milestones
- Chrome 151's Wednesday patch resolved 370 vulnerabilities — 349 self-reported by Google and seven rated critical — pushing the three-release total to 1,442 flaws
- The National Vulnerability Database has logged 46,872 flaws so far in 2026, approaching the 49,920 reported for all of 2025, a surge Google attributes to LLM-accelerated discovery outpacing fix capacity
- A critical sandbox-escape flaw (CVE-2026-3545, CVSS 9.6) in Chrome's Navigation component — patched in March — went undetected in source code for over 13 years until a Gemini-powered agent harness surfaced it
- Google is piloting two security releases per week alongside its transition to a two-week major-release cadence, citing "fast-moving, AI-powered attacks" as the driver
- Chrome is exploring dynamic patching that swaps background child processes on the fly using its multi-process architecture, aiming to apply fixes without forcing user restarts
- Google is hardening Chrome by migrating to memory-safe languages like Rust and building the browser's top-level UI in HTML, CSS, and TypeScript to eliminate classes of memory-safety bugs
- All Chrome third-party dependencies are being moved onto automated update pipelines to keep them current without manual intervention
Why it matters: With NVD-recorded vulnerabilities in 2026 already nearing 2025's full-year total and LLM tooling accelerating both discovery and exploitation, Chrome users face a shrinking window between bug disclosure and active attacks. Google's response — twice-weekly security releases, dynamic hot-patching, and a Rust migration — directly targets that compression, but the 349 of 370 Chrome 151 flaws self-found by Google shows internal detection is now doing the heavy lifting that external researchers once did.
