Google's AI Just Found a Chrome Bug That Hid From Humans for 13 Years

<h2> The number that should worry you </h2> <p>Chrome 149 and 150 shipped with <strong>1,072 security bugs fixed, combined</strong>. That's not a typo. That's more than the <em>previous 23 major Chrome releases fixed put together</em>.</p> <p>Sit with that. Two release cycles beat nearly two years of a world-class security team's output. If your first reaction is "wow, AI is amazing," your second reaction should be "wait, how many of those bugs were sitting in production this whole time?"</p> <p>Because that's the actual story here. Not that AI writes better exploits — it's that AI is finally good enough to read code at a scale humans never could, and Chrome's codebase has been carrying more risk than anyone wanted to admit.</p> <h2> The bug that beat everyone for 13 years </h2> <p>The headline find: a Chrome sandbox escape tracked as <strong>CVE-2026-3545</strong>, CVSS score <strong>9.8</strong>. It let a compromised renderer trick the browser into reading local files off disk — a full sandbox breakout, one of the nastiest bug classes in browser security.</p> <p>It had been sitting in the codebase for <strong>more than 13 years</strong>. Survived code review. Survived fuzzing. Survived every external researcher who ever looked for a payday through Chrome's Vulnerability Reward Program. Google patched it quietly in Chrome 145 back in May, and only talked about it publicly <a href="https://blog.google/security/chrome-stronger-with-every-update/" rel="noopener noreferrer">now</a>.</p> <p>Thirteen years means this bug predates most of the security tooling currently protecting your production stack. It shipped before OSS-Fuzz existed in its current form. It survived Heartbleed-era paranoia, Spectre-era paranoia, and about four generations of static analyzers. What finally caught it wasn't a smarter human — it was an agent that could hold the whole call graph in its head at once and didn't get bored on day three.</p> <h2> What's actually running under the hood </h2> <p>Google isn't just pointing ChatGPT at a repo and hoping. There's a real pipeline, and the names matter if you want to understand what transfers to your own codebase:</p> <ul> <li> <strong>Big Sleep</strong> — a Gemini-powered vulnerability discovery agent, built with DeepMind and Project Zero. Descendant of 2024's <strong>Naptime</strong> project, which gave LLMs specialized tools for vulnerability research instead of raw code access.</li> <li> <strong>CodeMender</strong> — wired directly into Chrome's CI. Runs every 24 hours against code changes, not just at release time.</li> <li> <strong>A fixing agent → critic agent loop</strong> — one agent proposes a patch, a second agent tears it apart looking for regressions or incomplete fixes, mimicking human code review. This is the part everyone skips over and it's the actual innovation. A single LLM generating patches is a liability. Two agents adversarially checking each other's work is a process.</li> <li> <strong>OSS-Fuzz</strong> — still running, still finding the bug classes AI is bad at. Google is explicit that fuzzing remains "especially effective" for long-range interaction bugs. AI didn't replace fuzzing. It replaced the <em>backlog</em>.</li> </ul> <p>That critic-agent detail is the one worth stealing for your own team, even without Google's budget:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight python"><code><span class="k">def</span> <span class="nf">review_patch</span><span class="p">(</span><span class="n">candidate_fix</span><span class="p">,</span> <span class="n">original_code</span><span class="p">,</span> <span class="n">cve_context</span><span class="p">):</span> <span class="c1"># Agent 1: generate a plausible fix </span> <span class="n">patch</span> <span class="o">=</span> <span class="n">fixer_agent</span><span class="p">.</span><span class="nf">propose</span><span class="p">(</span><span class="n">candidate_fix</span><span clas