Thought Leadership
Following significant cuts in April, Google is quadrupling the baseline bounty for memory safety vulnerabilities in Chrome to $2,000.
Google is once again increasing rewards for certain security vulnerabilities in Chrome, the company has announced. The focus is on memory safety flaws, for which the baseline bounty rises from $500 to $2,000. Even with the increase, the new rates remain well below the levels seen prior to April.
Google had significantly reduced standard bounties for several Chrome vulnerabilities in April to focus more on actionable reports. According to security researchers, some bounties dropped to a tenth of their previous amounts. Google cited the changed pace and methodology of vulnerability research driven by AI as the reason.
Up to $20,000 for Vulnerabilities in the Browser Process
For vulnerabilities in Chrome’s browser, GPU, and network processes, Google is now paying up to $20,000. Use-after-free and memory write errors in the renderer process are rewarded with up to $8,000. A fixed amount of $5,000 applies to flaws in the V8 sandbox, while logic errors in the V8 JavaScript engine are awarded $4,000.
For non-memory safety vulnerabilities, researchers receive $2,000 for medium-severity flaws if the report includes a fix or directly leads to one. Non-memory sandbox escapes can yield up to $20,000. In addition, Google is reinstating a $2,000 bonus for developing new fuzzers.
“All submissions currently in our review queue that were submitted after April 30, 2026, will be evaluated and rewarded under the new payout structure.”
In early October, Google had temporarily suspended the acceptance of new reports on product vulnerabilities in its Open Source Software Vulnerability Reward Program (OSS VRP). The reason was a flood of automated, predominantly invalid submissions.
(Editorial Team)
