Overview
- Google increased the base reward for memory-corruption bugs to $2,000 and set top payouts of as much as $20,000 for controlled memory writes in Chrome’s browser, GPU, and network processes.
- Process- and engine-level caps include up to $8,000 for renderer writes and use-after-free, $5,000 for V8 sandbox issues, and $4,000 for V8 logic bugs.
- The company will pay $2,000 for medium-severity, non-memory reports that include or directly lead to a fix and will offer up to $20,000 for high-impact non-memory sandbox escapes.
- Google reinstated a $2,000 Chrome Fuzzer Bonus to reward novel fuzzers, applied the new payout rules immediately, and confirmed submissions made after April 30 that remain in its queue will be re-evaluated under the update.
- The move partially reverses April cuts to rebalance researcher incentives toward actionable, high-impact findings and responds to a recent surge in low-value, AI-generated reports that has also prompted the temporary closure of the OSS VRP to product vulnerability submissions.