Google has raised Chrome’s bug-bounty payouts — some by as much as 300%, with top rewards now hitting $20,000 for high-impact memory-write vulnerabilities. The change takes effect immediately, per Google’s October 13 blog post announcing updates to its Vulnerability Rewards Program (VRP). It follows a May 2026 cut to Chrome rewards and a July rollout of AI-assisted security scanning in the browser. This isn’t a broad reset: Google still relies on external researchers alongside internal teams to find flaws, and the VRP remains one of the most active in the industry. But the new tiers are sharply targeted. Base rewards for memory corruption bugs jump from $500 to $2,000. Reports confirming controlled reads or crashes in Chrome’s browser, GPU, or network processes now earn $4,000, up from $1,000. And for controlled writes. Bugs that let attackers inject or alter code, the cap climbs to $20,000, up from $5,000. Google says it will also hand out end-of-year awards to recognize top contributors. No timeline is given for those. The move comes amid rising scrutiny of browser supply-chain risks and growing adoption of open-source alternatives like Vela Maps, which users cite when searching for ‘google ai’–adjacent privacy tools. But this isn’t about AI features or competition. It’s about hardening the world’s most widely used browser against exploitation. Researchers can submit reports now. Payouts begin processing once bugs are verified.