Google Adds $250,000 Reward for Critical Google Cloud Security Bugs

Summary

Google's Cloud VRP now offers up to $250,000 for qualifying Root-in-Cloud flaws that enable full administrative control over arbitrary Google Cloud organizations or projects, subject to strict eligibility and testing rules.

Key points

The new top-tier Cloud VRP reward is $250,000 for qualifying Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service flaws.
Researchers must demonstrate full administrative or IAM control over arbitrary Google Cloud organizations or projects, without prior access or special project setup.
Qualifying reports of RCE in Google's Borg production infrastructure or root-in-prod will be evaluated for Root-in-Cloud eligibility.
Exploits cannot rely on compromised credentials, social engineering, user interaction, or prior access to the victim project.
Researchers must stop probing after achieving production execution; escalation, production credential access, and lateral movement are prohibited.
Google provides a designated-service-account proof mechanism so researchers can demonstrate unauthorized access without testing against real customer projects.

Article Details

Event Type: Google expanded its Cloud Vulnerability Reward Program with a new top-tier reward for high-impact architectural security flaws.
Impact: Eligible reports demonstrating full administrative control over arbitrary Google Cloud organizations or projects can receive $250,000. The program also allows qualifying reports of remote code execution in Borg or root-in-production access to be evaluated for the reward. Researchers must use the designated proof-of-root mechanism and avoid testing against real customer projects; prior access, compromised credentials, social engineering, and user interaction disqualify exploits.

People

Chris BetzIdentified as Google Cloud's Chief Information Security Officer; described the requirements for the new reward.Michael CoteIdentified as Cloud VRP Lead; described the program's safe rules of engagement and proof-of-root mechanism.

Vendors

GoogleGoogle adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs

Products

Borgreports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud Google Cloudcomplex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations.