In short: A Google research agent built on Gemini models found a critical Chrome vulnerability, CVE-2026-3545, that had been hiding in the code for more than 13 years. The flaw let a malicious web page escape the browser sandbox and read local files on your device. It is already fixed in shipped Chrome updates — if auto-update is on, you have done the most important part.
What happened
In late July 2026 Google revealed that its experimental AI vulnerability-hunting agent had uncovered a serious bug in Chrome's Navigation component. The flaw was assigned CVE-2026-3545 and a high severity score (9.6 out of 10 on the CVSS scale). What stands out is not just the find but the finder: the vulnerable code had existed for over 13 years, unnoticed by manual review. Our blog's threat breakdowns increasingly deal with exactly these "sleeping" bugs.
The agent does not work like an ordinary scanner: it studies git commit history and a database of past vulnerabilities, tracing how code evolved to spot places where an old fix opened a new hole. The analysis runs on isolated machines so the tool itself cannot become a source of risk.
Why CVE-2026-3545 is dangerous
The sandbox is a protective barrier that keeps a web page inside the browser and stops it from reaching files on disk. CVE-2026-3545 let that barrier be bypassed: a specially crafted page could make Chrome read local files — documents, saved data, parts of your profile. It is precisely the sandbox escape that makes such bugs so valuable to attackers: one visit to a malicious site, and private files are at risk.
This discovery is part of a bigger picture. Across three recent releases Chrome closed around 1,442 vulnerabilities — more than the previous 23 major versions combined. Google has moved to a faster release cycle and is gradually rewriting parts of the browser in Rust to cut down on memory-safety errors.
What it means for everyday users
The good news: this specific flaw is already patched, and there were no signs of mass exploitation before the fix shipped. The deeper takeaway is that AI now sits on both sides. Defenders use it to find bugs faster, but attackers use the same methods to hunt for new ones. "The browser will update itself eventually" is no longer a safe strategy.
It is important to know the limits of each defense. A bug like this fires inside the browser, on your device. No VPN "fixes" a hole in Chrome — that is the job of updates. Keep the layers separate: updates close bugs in software, a VPN handles privacy at the network level.
How to protect yourself
The steps are simple. First, open Chrome's menu → Help → About Google Chrome, confirm you are on the latest version, and turn on auto-update. The same goes for extensions — update them and remove the ones you do not use. Second, do not open links from unverified emails and messages: almost every browser attack begins with a visit to a prepared page.
Third, add a network privacy layer. The LiMP VPN app encrypts your traffic and hides from your provider and network owner which sites you open, and thanks to its no-logs policy the service itself keeps no record of your visits. A VPN does not replace browser updates — it complements them: updates protect the device, a VPN protects data in transit. Together, that is defense in depth.