Overview
- Google raised the base reward for memory-safety vulnerabilities to $2,000 and set component-specific ceilings, including up to $20,000 for browser, GPU and network process issues, up to $8,000 for renderer use-after-free and memory write bugs, $5,000 for V8 sandbox flaws and $4,000 for V8 logic bugs.
- The company reintroduced a $2,000 Chrome fuzzer bonus and will pay a flat $2,000 for medium-severity non-memory-safety flaws when the report includes or directly leads to a fix, while high-impact non-memory sandbox escapes can earn up to $20,000.
- Any reports that have been sitting in Google’s evaluation queue and were submitted after April 30, 2026 will be evaluated and paid under the newly announced reward rules.
- Google continues to limit product vulnerability submissions to its Open Source Software Vulnerability Reward Program because of a surge of AI-generated reports that have increased volume and reduced signal for analysts.
- The move reverses part of April’s broad payout cuts that sought to focus on actionable reports, and it leaves reward levels below pre-April rates as Google tries to balance researcher incentives with program workload and AI-driven noise.