Chrome moves to a two-week release cadence

Chrome is halving the gap between its major releases. Google says it is moving to a two-week cadence for major Chrome milestones, down from four weeks, starting with Chrome 153 on September 8, 2026. The reason it gives is that machine learning now finds security bugs faster than a four-week train can ship the fixes.

Two numbers explain the decision. Chrome 149 and 150 together fixed 1,072 security bugs. That is more than the previous 23 milestones produced combined.

What actually changes, and what does not

The two-week figure applies to major milestones, which are the numbered releases that carry new features. It is not the security patch schedule, and the distinction is easy to lose.

Track	Schedule
Major milestones	Every two weeks, from Chrome 153
Security updates	Weekly
Security updates (pilot)	Twice weekly

"We are in the process of transitioning to a two-week cadence for major Chrome milestones, with weekly security updates," Google's Chrome Security Team wrote. It is separately piloting a shift to two security releases per week.

The change covers desktop, iOS and Android. TechCrunch reports that Mozilla, Microsoft Edge and Brave have already adopted matching two-week schedules.

Why the bug count jumped

The security team is direct about the cause. Large language models are the software behind chatbots, and they can be pointed at source code to hunt for flaws.

"Large Language Models (LLMs) are unlocking unprecedented capabilities for automated vulnerability discovery," the team wrote. It described that as scaling far beyond the limits of human security expertise, and said it demands new approaches to stay ahead of attackers.

That cuts both ways, which is the part worth sitting with. The same tools help attackers. Google's stated goal is to shrink the N-day gap, meaning the window between a fix landing in the public codebase and reaching users. Chromium is open source, so every published fix is also a public description of the bug it fixes.

In May 2026 alone, Google says automated systems stopped more than 20 vulnerabilities from reaching production. One was rated S1+, its most severe category.

What this means for developers

Your testing assumptions need a look. If your release process pins a Chrome version or runs a browser matrix, that matrix now moves twice as often. A quarterly check against "current Chrome" is no longer the same thing it was in August.

For anything you cannot re-qualify every two weeks, Google points at the Chrome Extended Stable Channel, which it recommends for enterprise and sensitive environments. That channel trades feature currency for a slower, predictable cycle, and it is the right default for regulated deployments.

Deprecation timelines are the open question. Neither source says whether removals and origin trials keep their existing milestone counts. If a deprecation was scheduled in milestones rather than dates, its calendar date just moved closer, so check anything you rely on that is already flagged for removal. Extension developers have already had one hard deadline this month, after Google pulled every Manifest V2 extension from the Chrome Web Store on September 1.

Do not read the 1,072 figure as Chrome getting less safe. It is what happens when automated discovery is turned on a large codebase, and finding a bug is the step before fixing it. The number to watch is how quickly patches reach users, not how many bugs get counted.

The wider point for the web platform: features will now land in stable in smaller increments, more often. That favors teams that test continuously and penalises long manual QA cycles. Google is also under competitive pressure here, since it says AI-assisted development has lowered the cost of building a browser at all.