Google is developing a new update system for the Chrome browser that allows security patches to be applied without requiring a restart [1].
This shift addresses a critical gap in software security where users ignore update prompts for days or weeks. By eliminating the restart requirement, Google aims to close the window of opportunity for attackers to exploit known vulnerabilities before a user refreshes their browser [2].
Google said it is "investing in 'dynamic patching' that will eliminate the need for a full browser restart" [1]. The company said that the time spent waiting for a user to restart the browser is a significant contributor to what is known as N-day exploitation risk [2]. This occurs when a vulnerability is publicly disclosed and patched by the developer, but remains open on the user's machine because the update has not been finalized through a restart.
The scale of these maintenance efforts is substantial. Google said that Chrome versions 149 and 150 alone contained 1,072 bug fixes [1]. While the company can often triage, fix, test, and release a patch within one to two days [2], the actual security of the user depends on the update being active in the live session.
Dynamic patching would allow the browser to swap out vulnerable code for secure code in the background. This process removes the friction of the "Update" button and the subsequent loss of open tabs or active workflows, a common deterrent for users who delay browser restarts [3].
Google has not yet provided a specific release date for the dynamic patching feature, but the effort represents a move toward a more seamless, invisible security model for the web's most popular browser [1].
“"investing in 'dynamic patching' that will eliminate the need for a full browser restart"”
This move signals a transition from user-dependent security to automated system integrity. By removing the restart requirement, Google is acknowledging that human behavior is the weakest link in the security chain. If successful, this could significantly lower the success rate of N-day attacks across the web ecosystem by ensuring that the time between a patch release and its implementation is measured in minutes rather than days.
