Hacker News front pageJul 31, 2026, 15:29 UTC+8

Google used Gemini to find, triage, and patch Chrome bugs—June fixes topped the prior two years combined

Google fixed more Chrome bugs in June than over the past two years, thanks to AI

Google’s Chrome Security team wired Gemini and other models into the full vulnerability lifecycle—fuzzing, triage, and patch generation. In June alone they fixed over 300 security bugs, more than in all of 2024 and 2025 combined. The system also surfaced a 13-year-old sandbox escape. Patch-to-merge time hit 30 minutes in some cases, though the post doesn’t disclose the Gemini version or false-positive rate.

Why it matters: Google's official blog details how Chrome security plugged Gemini models into the full vuln-to-patch pipeline, fixing 300+ bugs in June alone — more than 2024 and 2025 combined — and surfacing a 13-year-old sandbox escape. Concrete numbers and workflow make it real. Held at 78...

Read the original ↗Export Markdown

Take

The headline number is wild: 300+ security bugs fixed in a single month, more than all of 2024 and 2025 combined. Google plugged Gemini and other models into the full pipeline—fuzzing, triage, patch generation—and even surfaced a 13-year-old sandbox escape. Patch-to-merge time hit 30 minutes in some cases, which is genuinely fast and puts real pressure on attackers.

I'd discount this a bit. It's a Google blog post, so no Gemini version, no false-positive rate, and no breakdown of how many bugs the AI found independently vs. just accelerated. The 300 total likely includes low-severity issues—don't read it as 300 critical RCEs.

Still, the direction matters. Browsers have massive attack surfaces, and human-only triage can't keep up. Wiring LLMs into the security pipeline as infrastructure beats one-off vulnerability-finding demos. The open questions: can they get the false-positive rate low enough for security teams to trust, and will this pipeline ever be open-sourced or offered to other projects.

Source: Hacker News front page · blog.google
Published: Jul 31, 2026, 15:29 UTC+8 · Jul 31, 2026