Google moves Chrome to a two-week update cycle to narrow the patch gap against AI-enabled threats

Google is shifting Chrome's desktop and mobile release cadence from a four-week cycle to a two-week cycle. This change directly addresses the shrinking timeline of modern cyberattacks, which are increasingly assisted by highly capable agentic AI. Threat actors can now use large language models to find and exploit vulnerabilities in hours or days rather than weeks or months. By accelerating updates, Google hopes to keep pace with these rapidly evolving threats.

The primary goal of this transition is to minimize the N-day patch gap, which is the time between a vulnerability's public disclosure and the deployment of a fix. Because Chrome relies on the open-source Chromium codebase, attackers actively monitor public code changes to identify potential exploits. Shortening the update cycle cuts the maximum duration of this exposure window from 28 days down to 14 days. This reduces the opportunity window for attackers to weaponize newly discovered flaws before users receive the patch.

Despite the faster release cadence, the strategy faces a major bottleneck in human behavior. A security patch is only effective once it is applied, and many users ignore update notifications for long periods. This issue is especially severe for unattended systems, such as kiosk computers, which may remain unpatched for months or years. To bypass this limitation, Google is currently investigating dynamic patching mechanisms that can secure the browser without requiring a full relaunch.