Chrome fixed 1,072 security bugs across two June releases

Google says Chrome 149 and 150 fixed 1,072 security bugs, more than the 1,036 fixed across the previous 23 milestones. The official Chrome security update gives Google's account of the broader security effort, while the comparison itself is about two June releases versus two years of earlier Chrome milestones—not every Chrome bug found in one month.

Definition: Chrome milestones are numbered stable-release versions; Chrome 149 and 150 were the two versions released in June 2026.

Proof: Google reports 1,072 security bugs fixed in those two milestones, compared with 1,036 across the previous 23 milestones.

Key takeaway: AI is increasing the volume of security work Chrome can process, while human review, testing and release speed still determine when users are protected.

Business impact: For operators, the important shift is from occasional vulnerability response to an always-on pipeline that can discover, prioritize, fix and ship security work at software-development scale.

What changed in Chrome’s June releases?

Chrome’s June result is a release-milestone comparison, not a simple monthly bug count. Chrome 149 and Chrome 150 together fixed 1,072 security bugs, while the 23 earlier milestones beginning around Chrome 126 accounted for 1,036 fixes across the prior two years; that is the numerical basis for Google’s claim that recent output surpassed the earlier period.

The distinction matters because “bugs fixed in June” can imply that one calendar month produced 1,072 fixes. The evidence supports a narrower statement: two Chrome stable milestones released in June contained that many security fixes, and the total exceeded the prior 23-milestone comparison.

How did AI enter the Chrome security story?

TechCrunch reports that Google used internal AI tools to help identify and patch Chrome security flaws at a larger scale. The company published a chart and a white paper about using AI to find vulnerabilities and repair them faster; the takeaway is that the result reflects a security-process change, not simply a new Chrome feature exposed to users.

Google Chrome engineering director Doug Turner said LLMs have “fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation.” Google also said models such as Gemini can help fix vulnerabilities preemptively, which frames AI as a defensive response to the growing volume and speed of software flaws. The distinction between a model and the system around it resembles the governed AI agent loop, although the source does not disclose Google's internal implementation in full.

What does the result mean for vulnerability management?

AI changes the economics of vulnerability management by making more code review and repair activity possible before attackers exploit a weakness. Doug Turner, Chrome’s director of engineering, told TechCrunch that LLMs have shifted vulnerability discovery toward an automated, industrial-scale operation; the operational takeaway is that defenders need pipelines that can absorb more findings without turning triage into a new bottleneck.

The broader trend is not limited to Chrome. TechCrunch also reported that Microsoft had patched a record 570 security flaws across its product lines and cited its own use of AI, while an independent count put Apple at 482 fixes in 2026. Those figures are not directly comparable with Chrome’s milestone totals, but they support the narrower conclusion that AI-assisted vulnerability work is changing how large software vendors measure defensive output.

The comparison still needs careful reading. The 1,072 figure covers security bugs fixed in two Chrome versions, not all Chrome bugs, and it does not prove that AI alone caused every fix. The useful signal is the scale of the claimed change: Google is reporting more security fixes in two recent milestones than across the previous 23 milestones combined.

What should security teams watch next?

The next meaningful question is whether other software vendors can reproduce the same increase in security fixes without making their comparisons impossible to interpret. Chrome’s result is a milestone count, Microsoft’s figure covers product lines, and Apple’s number comes from an independent count; security teams should therefore compare definitions and release windows before treating any one total as a universal benchmark.

The broader lesson from Chrome is that AI security tooling is becoming an operational system, not a standalone vulnerability scanner. Google’s 1,072-fix result shows what happens when a vendor connects vulnerability discovery and repair at large scale. That emphasis on governed, reviewable security workflows also appears in Yowox’s analysis of agentic cybersecurity platforms. The remaining question is whether higher automated throughput consistently produces fixes that reach users before attackers can exploit the underlying flaws.