New "Dynamic Patching" in Chrome Would Allow Updates Without Restarting

In a blog post, Google announced it is working on a system in Chrome to apply updates without needing to restart the browser in order to keep up with a mountain of patches.

AI in recent years has become remarkably good at finding bugs in software. In some cases, routinely finding bugs from over a decade ago in older projects like the Linux kernel.

In just version 149 and 150 of Chrome, Google fixed 1,072 bugs, more than all 23 prior milestones combined.

With the deluge of new security vulnerabilities found by AI tools, it's become more important than ever for companies to be able to release patches in a timely manner and get them installed on as many systems as possible.

Google has worked toward the first goal by moving to a two-week release cycle instead of the previous four-week release cycle in order to get patches out faster.

However, getting those patches installed on people's systems is another issue entirely. Many people find updates annoying and disruptive and refuse to update unless they are absolutely forced to.

Google claims to have pioneered the silent, background autoupdates that we're so used to now in many operating systems and other software. But although updates can be downloaded and installed without any user interaction, they still need to wait for you to restart your browser before the update can be applied.

They say they're looking into more ways they can find opportunities to restart automatically, for example macOS allowing apps to continue running in the background while all windows are closed allows Chrome to detect this and restart automatically as of version 150.

Over the longer term though, they want to leverage Chrome's multi-process architecture to allow different background processes to be restarted individually and have updates applied, without restarted Chrome as a whole and disrupting the user experience.

Eventually the vision is to have a browser that is always updated with the latest patches with minimal disruptions.

Beyond that, they're continuing investment into memory-safe languages and improving memory safety for older C++ code.

It's now more important than ever for companies to eliminate entire classes of vulnerabilities like Rust does with memory safety issues. Relying purely on a reactive approach and playing whack-a-mole with vulnerabilities simply isn't sustainable anymore.