cyber.hendryadrian.com
Security News · bleepingcomputer.com

Google Restructures Android and Chrome Bug Bounties, Offering Up to $1.5 Million

· Original article ↗

Summary

Google is increasing top rewards for difficult Android and Chrome exploits while reducing payouts for some flaws it says AI makes easier to find. It also narrowed submission priorities and reported $17.1 million in 2025 payouts.

Key points

  • A zero-click Pixel Titan M2 full-chain exploit with persistence is eligible for up to $1.5 million; without persistence, the maximum is $750,000.
  • Chrome full-chain browser process exploits on up-to-date systems can earn up to $250,000, plus a $250,128 bonus for exploiting MiraclePtr-protected allocations.
  • Chrome submissions should focus on concise bug proofs and essential artifacts rather than lengthy analyses.
  • Android rewards will focus on Linux kernel vulnerabilities in Google-maintained components unless researchers demonstrate exploitability on Android devices.
  • Google paid $17.1 million to 747 researchers in 2025, bringing total program payouts since 2010 to more than $81.6 million.

Article Details

Event Type
Google restructured its Android and Chrome vulnerability reward programs.
Impact
The programs prioritize difficult, high-impact exploits while reducing rewards for flaws considered easier to find with AI. Qualifying zero-click Pixel Titan M2 full-chain exploits with persistence can earn up to $1.5 million; Chrome full-chain browser-process exploits can earn up to $250,000, with a $250,128 bonus for exploiting MiraclePtr-protected allocations. Google also narrowed Android submissions toward vulnerabilities in Google-maintained Linux kernel components unless device exploitability is demonstrated, and shifted Chrome submissions toward concise reports with proofs and essential artifacts.

Vendors

GoogleGoogle has restructured its Android and Chrome vulnerability reward programs to prioritize the highest-impact, hardest-to-achieve exploits while reducing payouts for flaws that AI has made easier to find.

Products

AndroidGoogle has restructured its Android and Chrome vulnerability reward programs to prioritize the highest-impact, hardest-to-achieve exploits while reducing payouts for flaws that AI has made easier to find.Google ChromeGoogle has restructured its Android and Chrome vulnerability reward programs to prioritize the highest-impact, hardest-to-achieve exploits while reducing payouts for flaws that AI has made easier to find.Pixel Titan M2Top prizes include up to $1.5 million for zero-click Pixel Titan M2 full-chain exploits with persistence and up to $250,000 (plus a $250,128 MiraclePtr bonus) for full-chain Chrome process exploits.

Related Articles