- Chrome uses AI-powered vulnerability detection, including LLMs like Gemini, to find and fix security bugs faster, with examples like Big Sleep and a sandbox escape bug that lasted 13 years.
- AI systems operate with safety guardrails: locked-down machines, no internet access, strict network allowlists, and no unrestricted mode.
- Automated triage processes filter noise, reproduce bugs, enrich metadata, and assign issues, saving hundreds of developer hours per month.
- Multi-agent workflows generate candidate fixes, evaluate them, and write tests, leading to 1072 security bugs fixed in Chrome 149/150, surpassing the previous 23 milestones combined.
- Release cadence is accelerating to two security updates per week, with dynamic patching to eliminate full browser restarts and auto-restart on macOS when no windows are open.
- Memory safety improvements include MiraclePtr, spanification, and structural hardening, alongside a shift to Rust for long-term resilience.
- AI-powered bug-finding is integrated into the commit queue to catch vulnerabilities before they land, including latent security issues from complex interactions.
- Chrome supports open source security via donations to Alpha-Omega and the Akrites project, and automates third-party dependency updates to reduce risk.