Google employed an AI-powered agent harness leveraging large language models and a knowledge base of Chrome's code history and prior CVEs to identify vulnerabilities more efficiently. This approach led to the discovery of CVE-2026-3545, a sandbox escape vulnerability caused by insufficient data validation in the Navigation component of Chrome. The flaw could be exploited via crafted HTML pages to trick the browser into reading local files. This vulnerability had persisted unnoticed for 13 years and was patched in Chrome 145 in early May 2026. The AI harness also supports generating candidate fixes and accelerating the patching process, contributing to a record number of security fixes in recent Chrome releases.

The vulnerability (CVE-2026-3545) had a CVSS score of 9.8, indicating critical severity. It allowed a compromised renderer process to escape the browser sandbox by tricking Chrome into reading local files, potentially exposing sensitive information or enabling further exploitation. The flaw's long presence (13 years) increased the risk that it could have been exploited if discovered by attackers. However, there are no known exploits in the wild as of the report date. The patch in Chrome 145 mitigates this risk.

An official fix for CVE-2026-3545 was released by Google in Chrome 145 in early May 2026. Users should ensure their Chrome browsers are updated to version 145 or later to mitigate this vulnerability. Google manages remediation for this non-cloud service product through regular browser updates. No additional action is required beyond applying the official patch. Google is also piloting accelerated release cadences and dynamic patching to reduce the window of exposure for future vulnerabilities.