Google is raising the financial stakes for researchers probing Google Chrome for security holes, pushing maximum bounties to $20,000 for the most dangerous vulnerabilities.
The update reshuffles payout tiers across Chrome's vulnerability reward system, focusing fresh money on the hardest exploits. Base rewards for locating memory corruption flaws have quadrupled to $2,000. If an issue involves controlled reads, crashes, or compromises in the browser's GPU or network processes, the baseline payout climbs to $4,000.
Critical flaws will yield much larger sums. Google will now pay up to $20,000 for controlled writes that give attackers precise control over system memory, matching the ceiling it sets for other high-impact bugs.
Exploits trapped inside the renderer process get their own pricing bump. Google is offering up to $8,000 for use-after-free flaws and memory writes inside the renderer. Meanwhile, bugs inside Chrome's V8 JavaScript engine are getting standardized rates. Researchers who report V8 sandbox issues will receive a flat $5,000, while V8 logic bugs will pay out $4,000. Google also added a $2,000 baseline payout for medium-severity issues that fall outside the traditional memory-safety category.
Alongside the adjusted bounty tables, Google is reviving its Chrome Fuzzer Bonus. The incentive grants an extra $2,000 to independent researchers who build and submit novel, custom fuzzing tools. Fuzzing relies on generating deliberate streams of irregular or malformed inputs to trigger unexpected crashes and reveal hidden software weaknesses. Bringing back the bonus is intended to ensure automated testing catches edge cases before active exploit campaigns can weaponize them.
The expanded payouts follow a busy year of defensive patching across the Chromium engine. A vulnerability disclosed in May carried the risk of converting millions of Android handsets into botnets, while a zero-day exploit caught in June permitted remote code execution via weaponized web pages. Chrome's massive global install base means single software defects routinely put broad swaths of mobile and desktop users in jeopardy.
Security researchers submitting eligible disclosures can claim the updated rates immediately through Google's established bug tracking pipeline.
SDFiled by The Software Desk
Apps, platforms, operating system releases, security fixes and the features arriving in them.
More from this desk →
Be the first to comment
Join the argument. No password, just your email or a passkey.