News · 2026-09-03

An AI agent found a Chrome security bug that had hidden in the code for 13 years

Google's Chrome Security team says an AI agent harness running Gemini found a vulnerability that had "quietly survived in our codebase for more than 13 years." The bug, tracked as CVE-2026-3545 and described in Chrome's release notes as insufficient data validation in navigation, was reported internally on February 24, 2026 and fixed in the Chrome Stable channel update of March 3, 2026. It sat undiscovered in one of the most heavily audited codebases on earth.

Key facts

• CVE-2026-3545 / Chromium issue 487383169, "Insufficient data validation in Navigation," reported by Google on 2026-02-24 and shipped in the March 3, 2026 Chrome Stable update.
• Google says the bug survived more than 13 years in the Chromium codebase before an AI agent harness found it.
• The same CVE was later echoed in ChromeOS long-term support release notes.
• Primary sources: Google's Chrome Security blog and the Chrome Stable channel release notes.

Thirteen years is the number that should stop you. Chromium is open source, continuously fuzzed, subject to one of the largest bug bounty programs in the industry, and read by security researchers professionally and recreationally. A vulnerability class that survives that for over a decade is not obscure because it is exotic. It is obscure because it lives in a boring place nobody thought to look twice.

The mechanism, in plain terms. Chrome splits itself into a privileged browser process and sandboxed renderer processes that handle untrusted web content -- the whole design assumes a renderer will eventually be compromised, so the sandbox contains the damage. Navigation state, the record of where you have been and what was on those pages, gets passed from renderer to browser as a structure called PageState. In Chromium, RenderFrameHostImpl::OnUpdateState is supposed to reject a PageState if the process cannot access every file it references. A browser test named PageStateWithUnlistedFile checks exactly this: it injects a fake path (/tmp/offlimits) into a PageState and expects the renderer to be killed for trying.

The exploit shape is a compromised renderer smuggling an unvalidated file reference into that navigation state -- effectively passing the browser process a note that says "and also, I'm allowed to touch this file," and having it believed. That is a sandbox-escape primitive, not a crash. It is the class of bug that turns a compromised tab into a compromised machine.

An analogy: imagine a secure building where visitors hand a clipboard to the front desk listing the rooms they have visited. The desk is supposed to verify every room on the list is one the visitor actually had access to. For thirteen years, one particular way of filling in the clipboard skipped the check.

Why an AI agent found it and humans did not is the interesting part, and it is not about intelligence. It is about patience and coverage. An agent harness can systematically walk validation paths across a codebase of tens of millions of lines, following each one to the end, without getting bored, without deciding a file looks unimportant, and without the pattern-matching shortcuts that make experienced reviewers fast and occasionally blind. Google's write-up frames it as a coverage win, and coverage is exactly what a decade of human review leaves gaps in.

This lands in the middle of the year's sharpest security argument. The same capability class -- an AI system that finds real, novel vulnerabilities in real software -- was formally designated Critical under OpenAI's Preparedness Framework days ago, when the company said Astra had reached that threshold after finding unknown browser and operating-system flaws and chaining zero-days into a working exploit. Google went the other direction with distribution, gating its cyber-focused model behind a partner vetting program. Both companies are looking at the same capability and making opposite bets about who should hold it. Our explainer on jailbreaking and red-teaming covers the defensive side of that split.

There is also a volume problem hiding here. Google has already cut some Chrome bug bounty payouts because its own AI finds too many bugs -- an economic distortion nobody planned for, where automated discovery devalues the human researchers whose incentives kept the ecosystem honest.

Two caveats that need to travel with this story. First, the 13-year figure is Google's own claim, confirmed by nobody else; there is no independent corroboration of when the code path was introduced. Second, and more commonly mangled: the Chrome Security blog says "Gemini," generically. It does not name a model variant. Google's separate Gemini 3.8 Flash and Flash Cyber launch post says Flash Cyber found a different critical vulnerability in under two hours, but never identifies it as this Chrome bug. Anyone writing that Flash Cyber found the 13-year Chrome bug is inventing the connection.

Why it matters: this is the most concrete public evidence yet that agentic vulnerability discovery finds things a decade of fuzzing, bounties and expert review did not. That is unambiguously good when defenders run it first. The uncomfortable corollary is that the same harness pointed at software without a Google-sized security team finds the same class of bug, and nobody is obliged to report it.

Primary source, verified: read the paper →

Ground Truth. (2026, September 3). An AI agent found a Chrome security bug that had hidden in the code for 13 years. Ground Truth. https://groundtruth.day/news/an-ai-agent-found-a-chrome-bug-that-hid-for-thirteen-years.html

@misc{groundtruth:an-ai-agent-found-a-chrome-bug-that-hid-for-thirteen-years,
  title  = {An AI agent found a Chrome security bug that had hidden in the code for 13 years},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {sep},
  url    = {https://groundtruth.day/news/an-ai-agent-found-a-chrome-bug-that-hid-for-thirteen-years.html}
}

Topics: cybersecurity · ai-security · vulnerabilities · google · chrome · red-teaming · agents