Google’s recent release of Chrome 152 offers a useful case study. The update fixed 327 security vulnerabilities, including 10 rated critical and 61 rated high severity. Those numbers sound alarming, but they also show how browser security actually works.

Chrome, Edge and Safari are updated frequently, often on relatively short release cycles. Each new version may add features, improve performance or change how the browser handles websites and other content. Those changes can also introduce new flaws, which means every major release can send a new batch of vulnerabilities out to users along with the improvements.

Security experts have long pointed to the tension between getting new software out quickly and spending more time finding flaws before release. Bruce Schneier, one of the best-known experts in computer security, has argued that software companies balance the cost of additional developers, fewer features and longer development times against the cost of finding and patching security problems later. He has also warned that the market tends to reward new features and timely releases more readily than better security.

Chrome has followed a roughly four-week schedule for major releases, but Google recently announced that it is moving toward two-week intervals. Google says one reason for speeding up security updates is to reduce the period between fixing a vulnerability in its code and getting that fix onto users’ computers. Once a fix becomes visible in Chrome’s open-source code, attackers may be able to study it and work out how to exploit computers that have not yet received the patch.

Artificial intelligence gets the credit for changing how many security flaws Google can find and fix before releasing an update. Google began using large language models to expand security testing in 2023 and has since added increasingly sophisticated systems to search Chrome’s code for vulnerabilities. The results have been dramatic. Chrome 148 fixed 126 security flaws in May, followed by 429 in Chrome 149 in June. Google says Chrome 149 and 150 together fixed 1,072 security bugs, more than the previous 23 major versions combined.

Not every flaw poses the same threat, and recent releases suggest the current generation of AI security tools may be reaching a plateau in what they can find. But AI models themselves have improved rapidly over the past year, which raises the possibility that security tools built on newer models could become more capable as well. If that happens, browser makers may be able to uncover even more flaws in less time, which means more secure browser releases for you.

Looking at the most common types of vulnerabilities helps explain which flaws are most serious and, along the way, gives you a better understanding of how your browser and computer handle memory, permissions and data.

The largest single category in Chrome 152 was called “use after free,” with 50 such flaws. Nine of the 10 critical vulnerabilities were in this category. In this case, “free” does not refer to a price, but rather a computer process. Your computer constantly assigns portions of its memory to different jobs, then releases that memory when the job is finished. A use-after-free flaw occurs when software tries to use an area of memory after it has already been released. Sometimes that simply causes a crash. More serious versions can allow an attacker to manipulate that memory and potentially get the browser to run malicious code.

Another 50 flaws involved incorrect authorization. Browsers have rules determining what a website, extension or browser process is allowed to access. An authorization flaw means one of those checks can fail. Something with limited privileges could then gain access to data or functions it should not have.

Another group involved information leaks and other memory problems. An information leak allows data that should remain isolated to become available where it should not. That does not automatically mean passwords or banking information are exposed. The risk depends on the particular vulnerability.

Google said none of the Chrome 152 vulnerabilities was known to be actively exploited when the update was released. But once vulnerabilities and their fixes become known, delaying an update gives attackers more time to target computers still running the older software.

Chrome normally downloads updates in the background, but the new version is not fully installed until you restart the browser.

If, like me, you tend to keep Chrome open with many tabs, don’t let that stop you. When Chrome indicates that an update is waiting, launch it. You can also check manually by clicking the three-dot menu in the upper-right corner, selecting Help and then About Google Chrome. Once the update is installed, Chrome reopens your tabs exactly as they were. So if you take away just one thing from this column, let it be keeping up-to-date with browser releases, regardless of their frequency.

Leslie Meredith has been writing about technology for more than a decade. As a mom of four, value, usefulness and online safety take priority. Have a question? Email Leslie at asklesliemeredith@gmail.com.