Google Raises Chrome Bug Bounty Rewards for Memory Safety Flaws
Summary
Google is raising Chrome bug bounty payouts for memory safety flaws, including quadrupling base rewards to $2,000, while introducing updated rates for other bugs and restoring a fuzzer bonus.
Key points
- Base rewards for Chrome memory safety flaws rise from $500 to $2,000, though they remain below pre-April rates.
- Eligible flaws in Chrome’s browser, GPU and network processes can earn up to $20,000; renderer use-after-free and memory-write bugs can earn up to $8,000.
- V8 sandbox vulnerabilities receive a flat $5,000 reward, while V8 logic bugs receive $4,000.
- Medium-severity non-memory-safety flaws can earn $2,000 when a report includes or directly leads to an identified fix; non-memory-safety sandbox escapes can earn up to $20,000.
- Google is restoring a $2,000 bonus for developing novel fuzzers.
- Submissions in Google’s evaluation queue that were submitted after April 30, 2026, will be assessed under the new payout rules.
Article Details
- Event Type
- Google revised and increased rewards for selected Chrome vulnerability reports in its bug bounty program.
- Impact
- Base rewards for memory safety flaws increased from $500 to $2,000. Eligible vulnerabilities in Chrome's browser, GPU, and network processes can earn up to $20,000; renderer use-after-free and memory write bugs up to $8,000; V8 sandbox vulnerabilities a flat $5,000; and V8 logic bugs $4,000. Other specified rewards include $2,000 for qualifying medium-severity non-memory-safety reports, up to $20,000 for sandbox escapes not involving memory safety, and a reintroduced $2,000 bonus for novel fuzzers. The new rates remain below those offered before the April overhaul.
Vendors
Products
Google ChromeGoogle announced Tuesday that it’s raising bug bounty rewards for some Chrome vulnerabilities, focusing on memory safety issues.Open Source Software Vulnerability Reward Program (OSS VRP)Google recently announced it’s temporarily closing its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions, prompted by a growing number of AI-generated reports.V8V8 sandbox vulnerabilities are moving to a flat rate of $5,000, while V8 logic bugs will be rewarded with $4,000.