Chrome users used to wait for a complete shutdown before security updates took hold. That process left a window for attackers — the N-day gap — between patch release and restart. Now, Google says it’s working to close that gap by applying updates dynamically.
Instead of waiting for a full Chrome restart, updates can be applied by swapping out background processes such as the GPU or renderer. The method plays off Chrome’s existing multi-process structure. If it works as intended, most security fixes can take effect instantly — or close to it — without closing tabs, windows, or the browser itself.
The change is not live yet. Google is still testing the system. But it’s already in use in Chrome 150 for Mac, where the browser will restart automatically if no windows are open and an update is waiting. That takes advantage of how macOS keeps apps running in the background even when they look closed.
LLMs are hunting 13-year-old bugs now
Behind the scenes, Google is using AI models like Gemini to find bugs in Chrome. An automated agent harness scans the codebase and finds vulnerabilities with fewer false positives. One example? A bug hidden in the system for thirteen years.
Google keeps AI systems isolated — no internet access, locked-down machines. Every scan runs under strict network rules, with all activity tracked and allowed only if it matches a permitted set of actions. The AI agents can’t change the system or touch files beyond the source code they’re analyzing.
Once bugs are found, AI helps suggest fixes. A fixing agent creates multiple possible solutions, and a critic agent picks the best one. These agents work together like a code review system — ensuring code matches Chromium standards and works on all platforms.
Security updates in Chrome 149 and 150
The new system has already had results. In the past two milestones, Chrome 149 and 150, the team fixed 1072 security bugs. That’s more than all the security issues fixed in the previous 23 milestones combined.
The effort has also helped block 20 vulnerabilities from reaching production in May alone — including a critical S1+ issue. Test-writing agents help write and validate tests for these fixes, ensuring they work across Chrome platforms before a developer finalizes the patch.
Google has worked with DeepMind and Project Zero to build tools like BigSleep and CodeMender. These are part of the continuous integration setup now, checking for bugs every 24 hours across all code changes.
Chrome is switching to a two-week release cycle starting in September with security updates in between. However, Google says it’s considering introducing two weekly security updates to counter “fast-moving AI-powered attacks.”
Google is also trying to find “opportune moments to restart automatically, when we can guarantee a seamless session restore.”
“Our long-term vision is a browser that is always up-to-date — continuously and dynamically patched, and automatically restarted during opportune periods of minimal disruption,” Google writes.
