Google says it fixed more Chrome bugs in June than over the past two years, thanks to AI

Google just dropped a number that should make every security team pay attention. One thousand seventy-two vulnerabilities patched in a single month. That exceeds the total fixes shipped across the prior twenty-three Chrome releases spanning two full years. The company credits its internal large language models, specifically Gemini, for the surge. Chrome engineering director Doug Turner calls it a fundamental shift in the economics of cybersecurity. He is right. Vulnerability discovery has become an automated, industrial-scale operation.

The chart Google published tells the story in a way no press release can. Chrome 126 landed in June 2024. Chrome 149 and 150 landed last month. The curve between them is not linear. It is exponential. For years, security researchers warned that AI would supercharge bug hunting on both sides of the fence. Attackers would find flaws faster. Defenders would need AI just to keep pace. Google's data suggests the defenders have arrived first — or at least arrived louder.

Microsoft's June Patch Tuesday reinforces the pattern. Five hundred seventy fixes across its product portfolio, a record the company explicitly attributes to its own AI tooling. Two giants. Two simultaneous spikes. Two explicit attributions to machine learning. This is not coincidence. It is the leading edge of a new baseline.

Apple sits conspicuously apart. Independent counts show roughly 482 fixes in 2026 so far, tracking roughly even with 2025 and remarkably similar to 2015. No exponential curve. No public AI narrative. Cupertino's silence when asked for comment speaks louder than a denial would. Either Apple is not applying LLMs at comparable scale, or it is not measuring the same way, or it is choosing not to talk. None of those explanations inspire confidence.

The industry has long treated vulnerability counts as a proxy for product health. More bugs found and fixed means more eyes on the code. That logic holds only if the discovery mechanism stays constant. It has not. When an LLM can fuzz, reason, and pattern-match across millions of lines of code without fatigue, the denominator changes. A thousand fixes in June does not mean Chrome suddenly became buggier. It means the flashlight got brighter.

Turner's phrasing — "preemptively fixing vulnerabilities, outpacing our adversaries" — carries an implicit claim: Google is now finding bugs faster than attackers can exploit them. That is a bold assertion. It deserves scrutiny. Automated discovery at industrial scale also means automated false positives at industrial scale. The white paper Google released shows the triumphant curve. It does not show the noise floor. How many of those 1,072 fixes were genuine exploitable paths versus theoretical edge cases? The distinction matters. A patch that breaks an extension ecosystem for a vulnerability no attacker could reach is a net negative.

There is also the question of what happens when the attackers catch up. The same economics that let Google scale discovery let ransomware groups scale exploitation. The window between disclosure and weaponization has already collapsed to days. If AI compresses discovery to hours, the patch cycle must compress further. Google's two-release cadence in June suggests they know this. But the broader ecosystem — enterprise IT, embedded Chrome, downstream forks — cannot always move at that velocity.

Microsoft's parallel surge hints at a broader truth: the vendors with the deepest AI integration and the largest codebases will pull ahead. Everyone else falls behind. Open-source projects without Google-scale compute budgets face a widening gap. The Linux kernel, Firefox, critical infrastructure maintained by underfunded teams — they are now racing Ferraris on bicycles.

The Apple anomaly deepens the concern. If the world's most valuable company is not seeing or not reporting an AI-driven discovery spike, either the methodology fails on their codebase or they are not deploying it. Both are troubling. iOS and macOS remain high-value targets. A discovery gap there is a target rich environment for adversaries who do have the tooling.

Security leaders should treat June as a dividing line. The pre-AI vulnerability management playbook — triage, prioritize, patch on a schedule — is obsolete. The new playbook requires continuous automated discovery, real-time risk scoring, and deployment pipelines that can ship fixes in hours, not weeks. Google just demonstrated the former. The industry must now prove it can deliver the latter.

The numbers will only grow. Next month's Chrome release will likely top 1,072. Microsoft's July Patch Tuesday will likely exceed 570. The curve is exponential by design. The question is not whether the industry can keep up. The question is whether the industry has already accepted that it must.