cyber.hendryadrian.com
Security News · securityweek.com

Google Changes Chrome and Android Bug Bounty Rewards Amid AI-Driven Submissions

· Original article ↗

Summary

Google is shifting Chrome and Android bug bounty priorities toward actionable reports as AI-assisted submissions surge. Android maximum rewards rise for some flaws, while standard Chrome payouts fall; Google expects total 2026 rewards to increase.

Key points

  • Google is prioritizing high-impact Android and Google Devices flaws that are harder for AI tools to find.
  • Google will favor actionable reports, including proposed patches for most Android vulnerabilities, and focus Linux kernel rewards on Google-maintained components unless Android or device exploitability is demonstrated.
  • Maximum Pixel Titan M rewards rise to $1.5 million for zero-click exploits with persistence and $750,000 without persistence; secure-element data exfiltration rewards rise to $375,000.
  • Chrome’s base reward for memory-safety issues is now $500, with multipliers based on factors such as reachability and exploitability; some rewards have reportedly fallen tenfold.
  • Google is phasing out bonuses for arbitrary read/write and remote code execution bugs, while planning special Chrome configurations for researchers.
  • A full-chain Chrome exploit remains eligible for up to $250,000, and Google expects total rewards to rise in 2026 after paying a record $17.1 million in 2025.

Article Details

Event Type
Google revised its Chrome and Android Vulnerability Reward Programs in response to increased AI-assisted vulnerability discovery and submissions.
Impact
Google raised maximum Android and Google Devices rewards for certain high-impact exploits, including zero-click Pixel Titan M exploits with persistence, while reducing standard Chrome memory-safety payouts to a $500 base and ending bonuses for arbitrary read/write and remote code execution reports. Google is emphasizing concise, actionable reports with proof and, for most vulnerabilities, proposed patches. It expects total 2026 rewards to exceed the record $17.1 million paid in 2025. The article also reports that the Internet Bug Bounty program paused new reports amid an influx of AI-assisted research.

Vendors

AnthropicAdvanced AI tools such as Anthropic’s Claude Mythos and OpenAI’s GPT‑5.4‑Cyber are bringing significant changes to the vulnerability discovery landscape.GoogleGoogle has overhauled its Vulnerability Reward Programs (VRP) for Chrome and Android in response to a surge in the use of AI tools for vulnerability discovery.OpenAIAdvanced AI tools such as Anthropic’s Claude Mythos and OpenAI’s GPT‑5.4‑Cyber are bringing significant changes to the vulnerability discovery landscape.

Products

AndroidGoogle has overhauled its Vulnerability Reward Programs (VRP) for Chrome and Android in response to a surge in the use of AI tools for vulnerability discovery.Claude MythosAdvanced AI tools such as Anthropic’s Claude Mythos and OpenAI’s GPT‑5.4‑Cyber are bringing significant changes to the vulnerability discovery landscape.Google ChromeGoogle has overhauled its Vulnerability Reward Programs (VRP) for Chrome and Android in response to a surge in the use of AI tools for vulnerability discovery.Pixel Titan Mthe maximum payouts have increased considerably, from $1 million to $1.5 million for zero-click Pixel Titan M exploits with persistence, and from $500,000 to $750,000 for exploits without persistence.

Related Articles