Google AI Uncovers 13-Year-Old Critical Chrome Bug Missed by Human Reviewers

·5 views

Google's AI-powered security agent, Big Sleep, discovered a critical Chrome sandbox escape vulnerability (CVE-2026-3545, CVSS 9.8) that had existed in the codebase for over 13 years. The flaw allowed a compromised renderer to access local files on disk and had survived multiple code reviews, fuzzing cycles, and external researcher scrutiny. Google quietly patched the bug in Chrome 145 in May before publicly disclosing it. The discovery came as part of a broader AI-driven security push that fixed a combined 1,072 bugs across Chrome versions 149 and 150 — more than the previous 23 major releases combined. Google's pipeline pairs a Gemini-based fixing agent with an adversarial critic agent that actively challenges proposed patches, a process the company credits as key to the program's effectiveness.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Solo Developer Built a Gulf Nation's Port SSO Platform in 7 Months Using AI Coding Tools

A solution architect with 17 years of experience served as the sole feature developer on a national single-sign-on platform for a Gulf country's port and logistics sector from December 2025 to July 2026. The system, now live in production, involved 602 commits and roughly 184,000 lines of code changed across 1,423 files, covering 83 REST endpoints and 62 Angular components. The developer estimated the project would have required three to four engineers over three months without AI assistance, with Claude handling a significant portion of the code authoring. The architecture followed a strict hexagonal design with CQRS, ensuring the core domain layer remained entirely free of framework dependencies — a standard the developer notes most projects claiming the pattern fail to meet. Notable engineering challenges included building a manual X.509 metadata parser for a malformed government certificate, implementing hot-reloadable certificate logic that later self-healed during a live rotation, and correctly diagnosing unstable government APIs rather than pursuing a false network latency issue.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Multi-Function Calculator Hub Using React, Vite, and CSS

A web developer has built a multi-functional calculator platform called Calc-Masters, going beyond the typical single-calculator tutorial project. The app was built using React, Vite, and vanilla HTML/CSS, chosen for fast build times, component reusability, and lightweight performance. React's useReducer hook was used to manage complex calculator states cleanly, while CSS Grid handled responsive keypad layouts without any JavaScript. Accessibility was prioritized through semantic HTML and aria-live attributes to support screen reader users. The finished application reportedly scores near 100% on Google Lighthouse performance metrics and is live at calc-masters.com.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

JSON Schema Field Order Silently Breaks AI Structured Output Reasoning

When using strict structured outputs with LLMs, the order in which fields are declared in a JSON Schema directly controls the order tokens are generated, because constrained decoding compiles schemas into finite-state machines. If a label or classification field appears before a rationale field, the model samples its answer before any reasoning tokens exist in context, making subsequent explanations post-hoc justifications rather than genuine reasoning. This means a simple reordering of a Pydantic model—with no other changes—can measurably reduce classification accuracy while leaving rationale text looking superficially convincing. The recommended fix is to place evidence and rationale fields before label and confidence fields, effectively implementing chain-of-thought reasoning within a JSON structure. Unlike unconstrained models that may self-correct field order, strict mode enforces schema order at the logit level, removing any such fallback behavior.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MemoFS Gives AI Coding Agents Persistent Memory Across Sessions and Subagents

AI coding agents like Claude Code, Cursor, and OpenAI Codex lose all context at the start of each new session, causing repeated confusion over project rules and dependencies. MemoFS is an open-source, file-based memory runtime designed to solve this by persisting project knowledge across sessions, subagent spawns, and context-window compactions. It supports three integration modes: lifecycle hooks for Claude Code and Codex, a Model Context Protocol server for Cursor and Copilot, and a TypeScript SDK for custom agent frameworks. Developers can initialize MemoFS in any project directory using a single CLI command, which creates structured memory files including a core briefing and long-term notes store. Once configured, MemoFS automatically injects relevant project context into agent prompts at session start and re-injects it whenever the agent compacts its context window.

0 comments Read more at DEV Community