Google has raised Chrome’s bug-bounty payouts — some by as much as 300%, with top rewards now hitting $20,000 for high-impact memory-write vulnerabilities. The change takes effect immediately, per Google’s October 13 blog post announcing updates to its Vulnerability Rewards Program (VRP). It follows a May 2026 cut to Chrome rewards and a July rollout of AI-assisted security scanning in the browser.
This isn’t a broad reset: Google still relies on external researchers alongside internal teams to find flaws, and the VRP remains one of the most active in the industry. But the new tiers are sharply targeted. Base rewards for memory corruption bugs jump from $500 to $2,000. Reports confirming controlled reads or crashes in Chrome’s browser, GPU, or network processes now earn $4,000, up from $1,000.
And for controlled writes. Bugs that let attackers inject or alter code, the cap climbs to $20,000, up from $5,000. Google says it will also hand out end-of-year awards to recognize top contributors. No timeline is given for those.
Be the first to comment
Join the argument. No password, just your email or a passkey.