Chrome updates without browser restart: Google tackles AI-driven security threats

Chrome may get faster updates with no restart required

With Chrome, Google pioneered the rapid release model for browser security. Now, Google says updates may need to change in the face of AI security analysis. According to the company, the number of bug fixes in Chrome releases has skyrocketed in recent months because AI is detecting so many flaws. We could be looking at more frequent updates soon, but Google is also working on ways to get those updates rolled out without bothering you as much. Google has released two major Chrome milestone builds recently -- Chrome 149 in early June and Chrome 150 just a few weeks later. These two updates had a total of 1,072 bug fixes, which is more than the previous 23 releases combined. Such is the impact of giant cybersecurity AI models that can probe software for vulnerabilities at light speed. Some of these vulnerabilities were serious, too, with one bug hiding in the Chrome codebase for 13 years. If it had been exploited, an attacker could have bypassed the Chrome sandbox to make the browser access local files. With the vastly higher rate of vulnerability identification, Google is worried bad actors will also be able to identify software flaws faster. Its goal is to ensure your Chrome install is always up to date or as close to it as possible. The first step toward that is the two-week update cycle the company announced earlier in 2026, but it's now piloting a system that would update Chrome twice per week. This would get patches out the door faster, ensuring that browsers are ready for the threat of AI-fueled attacks. However, not everyone updates Chrome as soon as new versions are available. While Chrome will download and stage updates promptly, it relies on users to restart their browsers to complete installation. Google is looking at several ways to streamline that process. In Chrome 150, Google implemented a new update mechanism that takes advantage of the way macOS handles applications. Apps typically continue to run in the background even if their foreground windows are closed. If you close Chrome 150 on macOS without quitting, Chrome can take advantage of that state to update the browser install with what Google calls a "zero window restart." When you next open a Chrome window, you'll see the update has been taken care of. Google is also working on a technique it calls "dynamic patching." The intent is to improve Chrome's security model to allow for patches to be installed automatically without a browser restart. Google says it's still "investing" in dynamic patching, but it hopes to have more to share on this in the future. So, looking ahead, you should see more frequent Chrome updates, and they could be installed more smoothly on macOS. If dynamic patching works out, there will be even more updates you never notice.

Google is working on Chrome updates that don't require restarts

Google is working on a way to apply Chrome updates without requiring you to restart your browser. In a post on Thursday, Google outlines its approach to bug fixes in the age of AI, while noting that it's trying to make updates less disruptive by "investing in 'dynamic patching' that will eliminate the need for a full browser restart." According to Google, AI-powered security tools have already helped the company find and fix dozens of bugs. Chrome 149 and 150, for example, contained 1,072 bug fixes, exceeding the number of patches in the past 23 major releases combined. That's part of the reason why Chrome is switching to a two-week release cycle starting in September with security updates in between. However, Google says it's considering introducing two weekly security updates to counter "fast-moving AI-powered attacks." To make these updates go more smoothly, Google is trying to "shift the burden away" from users, who could be at risk of "N-day" attacks, which occur when hackers exploit newly released bug fixes that haven't yet been downloaded on a user's device. Along with working on dynamic patching, Google is also trying to find "opportune moments to restart automatically, when we can guarantee a seamless session restore." Google has already launched a version of this in Chrome 150 on macOS, as the browser takes advantage of a state "where applications typically continue running in the background even after all windows are closed." Chrome will automatically restart if it detects an update in this windowless state, Google says. "Our long-term vision is a browser that is always up-to-date -- continuously and dynamically patched, and automatically restarted during opportune periods of minimal disruption," Google writes.

Google wants to update Chrome without a full browser restart

Google today is out with a lengthy post describing the role of AI and LLMs in Chrome security. While it takes Google 1-2 days to triage, fix, test, and release a patch, the "time spent waiting for the user to restart Chrome can be a significant contributor to N-day exploitation risk," or the patch gap. Acknowledging the burden of having to restart, Google is investing in "dynamic matching" to "eliminate the need for a full browser restart in most cases." It works by replacing "background child processes (like the Renderer and GPU) with updated binaries on the fly." This approach leverages Chrome's multi-process architecture. The Chrome team is still researching and developing this feature. Google is also "exploring ways to ensure a seamless session restore even in complex cases, by saving more state locally." This will become more important when Chrome moves to its two-week update cycle later this year. Until then, Google is looking for "opportune moments to restart automatically, when we can guarantee a seamless session restore." In Chrome 150 for Mac, Google will restart the browser automatically when there's a pending update and no open user windows. For example, in Chrome 150, we rolled out a change to take advantage of the unique application state on macOS where applications typically continue running in the background even after all windows are closed. Google also discussed its latest use of LLMs to find bugs, with the process starting in 2023. Earlier this year, it created an agent harness that uses Gemini and other models to "find vulnerabilities across the broader Chrome codebase with higher efficiency and lower false positives." One notable find was a bug that had been in the codebase for 13 years. In terms of safety, some interesting process details were shared: * "Our AI analyzes source code strictly at rest, operating on locked-down machines that lack general internet access." * "We also utilize a dedicated setup for these internal scans that intercepts all network requests, employing strict allowlists based on the initiating application and destination, blocking any suspicious model activity." * "Furthermore, we never run models in an unrestricted mode, and we strictly limit our subagents from modifying the local system or accessing files outside of designated source code directories." * "We have partnered closely with Google DeepMind and Project Zero for years, including on BigSleep and CodeMender. These tools are natively integrated into our continuous integration (CI) system, running every 24 hours across all CLs to proactively detect security bugs. This integration has yielded significant results: in May alone, we blocked over 20 vulnerabilities from reaching production, including a critical S1+ issue." To fix vulnerabilities, there's now a multi-agent workflow, with LLMs generating candidate fixes for most of them: This process has resulted in a dramatic increase in security fixes: In the last two milestones, Chrome 149 and 150, we have fixed 1072 security bugs, surpassing the total number of security bugs fixed across the prior 23 milestones combined.