Google Chrome switching to weekly security patch updates

To better address the security patch gap, Google announced today that Chrome is now adopting weekly Stable channel updates.

Google’s browser gets major “milestone” updates every four (previously six) weeks, like going from version 100 to 101. In the past, Chrome would get a “Stable Refresh” update to “address security and other high impact bugs” in-between milestones every two weeks.

This is now changing to occur weekly between milestones, starting with Google Chrome 116 on desktop and mobile, so that security updates get to end users much faster.

Since Chromium is an open source project, “anyone can view the source code, submit changes for review, and see the changes made by anyone else, even security bug fixes.”

This openness has benefits in testing fixes and discovering bugs, but comes at a cost: bad actors could possibly take advantage of the visibility into these fixes and develop exploits to apply against browser users who haven’t yet received the fix. This exploitation of a known and patched security issue is referred to as n-day exploitation.

Google describes the process as such:

When a Chrome security bug is fixed, the fix is landed in the public Chromium source code repository. The fix is then publicly accessible and discoverable. After the patch is landed, individuals across Chrome are working to test and verify the patch, and evaluate security bug fixes for backporting to affected release branches. Security fixes impacting Stable channel then await the next Stable channel update once they have been backported. The time between the patch being landed and shipped in a Stable channel update is the patch gap.

The current patch gap is around 15 days. It was previously 35 days before switching to patch updates every two weeks in 2020. Google expects weekly patch updates to result in security fixes shipping “3.5 days sooner on average, greatly reducing the already small window for n-day attackers to develop and use an exploit against potential victims and making their lives much more difficult.”

This new schedule will also result in fewer unplanned updates that occur when there are known in-the-wild exploits: “By now shipping stable updates weekly, we expect the number of unplanned updates to decrease since we’ll be shipping updates more frequently.”

Meanwhile, Google is testing new ways to encourage users to update:

If an update is available, please update immediately each time!