Google’s AI Found a 13-Year-Old Chrome Security Bug — Here’s How
Some security vulnerabilities hide in plain sight for years. One flaw in Google Chrome sat undetected in the browser’s code since around 2013 — until an AI system built by Google finally caught it in 2026, more than a decade after it was first introduced.
What Was the Bug?
The vulnerability, officially designated CVE-2026-3545, scored a severe 9.8 out of 10 on the industry’s standard severity scale. It was a “sandbox escape” flaw — a type of bug that matters a lot for browser security. Normally, Chrome isolates web content inside a restricted “sandbox” so that even if a malicious website compromises part of the browser, it can’t reach the rest of your computer. This particular flaw could have let a compromised part of Chrome trick the browser into reading local files on a user’s device, breaking that isolation. Google patched it quietly in Chrome version 145, released in May 2026, before publicly detailing how it was found.
How the AI Found It
Google built what it calls an “agent harness” — an AI system powered by its Gemini models, specifically trained to comb through Chrome’s massive codebase hunting for vulnerabilities. Rather than randomly scanning code, the system combines a historical database of past security flaws with the browser’s Git commit history, essentially tracing how sections of code have evolved over years to spot patterns that resemble previously known vulnerability types. It runs this analysis on isolated, restricted machines to safely study inactive code without any real risk.
This wasn’t Google’s first attempt at AI-driven bug hunting — the company previously worked with Google DeepMind and Project Zero on a project called “Big Sleep,” which found flaws in Chrome’s JavaScript engine. But this newer, broader system is what finally caught the 13-year-old flaw that had slipped past human reviewers, automated fuzzing tools, and external bug bounty researchers for over a decade.
The Bigger Number Behind the Story
The 13-year-old bug wasn’t an isolated win — it validated a much larger shift in how Google is handling Chrome security. In just two recent releases (Chrome 149 and 150), Google’s AI-assisted pipeline helped fix 1,072 security bugs combined, more than the total number fixed across the previous 23 releases put together. Once a vulnerability is confirmed, a multi-agent workflow takes over: one AI agent drafts candidate fixes, another evaluates and critiques them, and a third writes tests, all before a human engineer even reviews the final patch.
What This Means Going Forward
Google has stated clearly that this AI system isn’t replacing human security researchers, fuzzing tools, or external bug reports — all of which remain active parts of Chrome’s security process. Instead, it’s being used to scale up detection to a level that wasn’t previously possible. Google is now piloting a shift toward releasing security patches multiple times a week instead of waiting for major version updates, aiming to shrink the window of time attackers have to exploit a known flaw before it’s fixed.
Read More :- Meta AI Now Available in Threads DMs Worldwide — What You Need to Know | Affitronix
Frequently Asked Questions
Was the 13-year-old Chrome bug ever exploited by attackers?
Google hasn’t confirmed any evidence of the flaw being actively exploited before it was discovered and patched.
Does this mean Chrome is now completely secure?
No — Google has been clear that AI is one layer among many, working alongside human researchers, fuzzing tools, and external bug bounty submissions.
Should I update my Chrome browser?
Yes, this fix was included in Chrome 145, so make sure your browser is updated to the latest version to stay protected.
