Standing Still on Chromium Costs $1.25M a Year.
That is the in-house floor: two Chromium engineers, half a QA and a build farm, before anyone ships a feature. We run that treadmill instead — as an outcome, under an SLA, against a patchset we rebase for a living. You keep every line of code that makes the product yours.
The treadmill, run as a pipeline.3
Measured on the white label Chromium platform behind around five partner browsers in production, two of them named here with permission. Not a projection.
The Treadmill, by the Numbers
September Was the Hinge.
All three figures are true today. The middle one doubled on 8 September 2026, and every milestone since runs on the two-week cycle.
Source: Chromium Dashboard release schedule and Chrome for Developers, 2026.
Fork Maintenance Is a Rate-Matching Problem. The Rate Just Changed.
The Cadence Doubled. The Volume Did Something Worse.
Google now uses LLMs to find and fix Chromium vulnerabilities at scale, and says so publicly. Alongside that, Chrome is running mechanical refactors across the whole tree: spanification, with 97% of first party code already compiling clean under strict unsafe buffer warnings and the effort now pushing into Skia, ANGLE and Dawn; MiraclePtr and MiracleObject expansion; Rust replacing parsers, image codecs and font stacks; and all 2,300 third party dependencies moving onto automated update pipelines.
Every one of those is good for Chrome users and bad for anyone carrying a patchset. A mechanical refactor that touches thousands of files is the single worst event for a downstream fork, because it conflicts everywhere at once and the commit history explaining it is increasingly machine authored. Browserbase said the same thing from the other side in November 2025: patching at the JavaScript layer did not give them enough control, so they forked Chromium, and it became hundreds of patches across hundreds of files with a dedicated build machine to hold the pace. Their account is the honest version of how most agent forks begin.
Every Skipped Milestone Compounds.
Rebase cost is not linear in the number of milestones you skip. Skipping one and rebasing across two milestones is materially harder than doing two single-milestone rebases, because upstream refactors interact: a signature change in one milestone and a file move in the next arrive together, without the intermediate state that would have explained either.
This Is the Part That Is Easy to Miss.
You can plan for a cadence change. You cannot plan for the tree being systematically rewritten underneath you at the same time.
| Posture | Migrations per year | Distance from upstream stable | Security dependency |
|---|---|---|---|
| Track Stable | 26 | Current | Your own pipeline. Fastest posture, highest cadence cost. |
| Extended Stable | 6 | One milestone behind | Google's backports, on Google's timing, one milestone behind. The twice-weekly security pilot ships to Extended Stable too, so you skip milestones, not security respins. More fixes upstream means more merging downstream. |
| Batch and Skip | 2–4 | Weeks to months behind | None you control. Viable for hobby forks, not under an SLA. |
Illustrative3
Nobody Rebases Twice as Fast.
Doubling the release rate does not double what a team can absorb.
Two Ways to Hand Over the Treadmill
We Take the Cycle, You Keep the Roadmap.
We take the Chromium update each cycle and hand you a rebased, green build. Your team merges only its own changes, and only on a genuine conflict.
Rebase Retainerevery cycle · under an SLA · 72h median from stable tag to green build todayBook a Discovery Call
Prove the Number in Three Days.
Patchset inventory, conflict surface, rebase debt, security window and your real annual figure.
The Fork Audit€14K · three days · fixed scope · readout inside ten working daysCredited in full against a rebase retainer signed within 60 days.
We rebase whatever is in your tree, including patches we would not have written. Stealth patches rebase like everything else. Your patchset is your IP; the treadmill is toil, and the toil is what we take.
Our patchset is not shaped like yours. Ours sits in branding, defaults and platform entitlements; yours is likely to sit in devtools, CDP and renderer hooks. The cadence discipline and the storage method transfer directly, and they are most of what we are selling. Our familiarity with your specific conflict mix does not, and we would rather say that here than have you discover it on the call.
If evasion is the real pain, say so on the call. It is separate work from rebase upkeep and we scope it separately, but it is not a door we close. What we will not do is claim a capability before we can measure it: we hold no test harness against Cloudflare, DataDome or Akamai today, so that work starts by building one and agreeing what it has to prove.
Signed identity is the other road, and the sanctioned one. Web Bot Auth is a chartered IETF working group on RFC 9421, deployed by Cloudflare and OpenAI. And from 15 September 2026, Cloudflare's defaults block agent and training crawlers on ad-supported pages for new domains, while search crawlers stay allowed. It needs no fork — an extension or a network hook does it — and we will say so when that is the cheaper answer.
The rebase arrives whether or not you are ready. From Chrome 153, it arrives twice as often.
Start With Your Own Number
Bring your patchset and how far behind stable you run. You leave knowing which of the two offers fits, or that neither does.
1Floor: (2 engineers + 0.5 QA) × $400K loaded + $250K infrastructure. The 40% is measured over 14 upstream majors on eight forks.
2Release cadence: Chrome for Developers, two-week release cycle announcement.
3Hero pipeline and the labelled fragment are illustrative.