Google AI Agent Finds 13-Year-Old Chrome Security Flaw

Google's Gemini AI agent uncovered a 13-year-old sandbox-escape vulnerability in the Chrome browser and assisted in a record-breaking patching effort ^[1].

This development signals a shift in cybersecurity, as AI is now capable of identifying deeply embedded flaws that human auditors missed for over a decade. The ability to automate the discovery and remediation of such vulnerabilities could significantly reduce the window of opportunity for attackers.

During two security releases in June 2024, Google patched 1,072 security bugs ^[2]. This volume of fixes in just two releases exceeded the number of bugs the company had patched in previous two-year periods ^[2]. The effort was driven by the use of the Gemini AI agent to scan the Chrome codebase for weaknesses ^[1].

One of the most significant finds was a sandbox-escape flaw that had existed in the code for 13 years ^[1]. Sandbox escapes are particularly dangerous because they allow malicious code to break out of the browser's restricted environment, and gain access to the underlying operating system ^[3].

To maintain this momentum, Google has piloted a strategy of issuing two security releases per week ^[2]. This accelerated cadence allows the company to deploy AI-discovered fixes more rapidly than traditional manual review cycles permit ^[2].

The use of AI for vulnerability discovery is part of a broader effort to improve Chrome's security architecture. By leveraging Gemini, Google aims to find and fix bugs before they can be exploited in the wild ^[1].