Google AI Harness Finds 13-Year-Old Chrome Sandbox Escape

Google has disclosed that a recent, unprecedented surge in Chrome vulnerability disclosures is being driven by an internal AI agent harness that scans the browser’s codebase for zero-days and legacy flaws. The automated system, built in early 2026 around Google’s Gemini models, has fundamentally shifted the pace of browser vulnerability management. The latest Chrome release included 370 security patches, bringing the total number of bugs fixed in Chrome this year to over 1,800. Across the Chrome 149 and Chrome 150 releases alone, Google resolved 1,072 security defects—a volume that exceeds the combined total of security fixes issued across the previous 23 milestone releases.

The effectiveness of AI-driven static analysis was highlighted by the discovery of a high-severity sandbox escape vulnerability that lay undetected in Chrome’s source code for 13 years. The flaw, tracked as CVE-2026-3545 with a CVSS score of 9.8, was surfaced by the agent harness and patched in May with the release of Chrome 145.

Anatomy of CVE-2026-3545 and the Renderer Sandbox

To understand the severity of CVE-2026-3545, it helps to examine how modern browsers isolate untrusted code. Google Chrome uses a multi-process architecture where untrusted web content (HTML, JavaScript, CSS) is rendered inside low-privilege renderer processes. These renderers run inside a tightly constrained sandbox designed to prevent malicious web pages from accessing local system files, touching sensitive OS APIs, or executing arbitrary host binaries.

CVE-2026-3545 stems from an insufficient data validation flaw in Chrome’s Navigation component. In a typical attack scenario, an adversary first gains execution inside a renderer process—often by exploiting an unpatched memory corruption bug in the V8 JavaScript engine or Blink rendering pipeline. Under normal circumstances, the sandbox keeps the attacker trapped inside that renderer context.

However, because the Navigation component failed to properly validate data passed across process boundaries, a compromised renderer could trick the primary browser process into reading arbitrary local files on the host file system. By passing specifically crafted HTML pages and manipulating navigation parameters, an attacker could force the privileged browser process to perform actions on behalf of the untrusted renderer, effectively achieving a complete sandbox escape.

How Google Built the Gemini Vulnerability Detection Engine

Google’s Chrome Security team has been experimenting with large language models since 2023, but the breakthrough in volume came with the agentic harness deployed earlier this year. Rather than relying on simple one-shot prompts or basic code completion, the system operates as a multi-agent harness:

• Training and Context: The harness was trained on Chrome’s complete Git commit history alongside a dedicated knowledge base of historic CVEs.
• Critic Agents and Documentation: The framework ingests developer-authored SECURITY.md files spread throughout the codebase, passing context to specialized “critic” agents that evaluate code logic against intended security invariants.
• Iterative Deep Scanning: The engine can execute vulnerability-finding models across the codebase in multiple passes to trace complex data flows across inter-process communication (IPC) boundaries.
• Isolated Environment: To eliminate security risks during scanning, the AI harness operates strictly at rest on hardened, air-gapped compute nodes without outbound internet connectivity.

Beyond bug hunting, Google is using AI agents to validate candidate bugs, assist human triagers, and automatically generate proposed pull requests for security fixes.

Structural Hardening and the Transition to Memory Safety

Finding and patching individual bugs addresses immediate exposures, but C++ memory corruption risks remain an inherent challenge for legacy browser engines. To complement the high-volume patch output, Google is using AI to eliminate entire bug classes by refactoring Chrome’s underlying execution environment.

To neutralize Use-After-Free (UAF) vulnerabilities—where a program continues using a pointer after the associated memory has been deallocated—Google is expanding its MiraclePtr defense across external libraries and deploying MiracleObject to the GPU main thread. To address buffer overreads and out-of-bounds writes, the engineering team is pushing a codebase-wide “spanification” refactoring effort, replacing raw pointer arithmetic with bounds-checked buffer views, while introducing memory allocation guards to stop integer overflow exploits before they reach the heap.

For long-term resilience, Google is shifting away from C++ in favor of memory-safe languages. The team has deployed a centralized Rust SDK within the build tree to write new modular components and systematically rewrite vulnerable C++ modules in Rust. Additionally, Google is testing implementations of Chrome’s top-level user interface using web technologies—HTML, CSS, and TypeScript—to reduce reliance on legacy C++ UI frameworks.

Closing the Patch Gap: Accelerated Releases and Dynamic Patching

The bottleneck in software security is often not finding the bug, but delivering the patch to end users before threat actors reverse-engineer the advisory and build a working exploit. To minimize this window, Google is piloting a twice-a-week security update cadence to supplement its standard two-week major release cycle.

To streamline this pipeline, Google is automating release note generation and CVE documentation directly from accepted fix commits. On user endpoints, Google is testing dynamic patching capabilities that update browser binaries in memory without requiring a full browser restart. Combined with seamless session restoration and background updates executed in a windowless state, these changes aim to ensure endpoints running Google Chrome receive continuous protection against zero-day flaws without disrupting user workflows.