cyber.hendryadrian.com
Security News · securityweek.com

Google Pauses Product Vulnerability Submissions to Its Open Source Bug Bounty Program

· Original article ↗

Summary

Google temporarily paused product vulnerability submissions to its Open Source Software Vulnerability Reward Program, citing a rise in mostly invalid automated reports. Supply-chain and pending reports are unaffected.

Key points

  • The pause was announced October 1 and applies only to product vulnerability submissions.
  • Reports submitted before October 1, 2026, pending reports, and supply-chain reports are unaffected.
  • Some vulnerabilities affecting Google Cloud products may still be reported through the Cloud VRP.
  • Google directed researchers to other reward programs and its Patch Rewards Program.
  • Google said it plans to provide an update on the OSS VRP in Q1 2027.
  • The change follows adjustments to Google's Chrome and Android reward programs amid increased AI-assisted vulnerability discovery.

Article Details

Event Type
Google temporarily paused product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) after a rise in automated reports, most of which it said were invalid.
Impact
The pause applies only to product vulnerability submissions and does not affect supply-chain reports or pending reports. Some vulnerabilities affecting Google Cloud products may still be submitted through the Cloud VRP. Google said it would provide an update on the OSS VRP in Q1 2027.

Vendors

GoogleGoogle has temporarily closed its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions, saying a growing number of automated reports, most of them invalid, prompted the move.

Products

AndroidThe OSS VRP pause follows changes Google made in May to its Chrome and Android reward programs, in response to the growing use of AI tools for vulnerability discovery.Cloud VRPGoogle Cloud products we may still accept reports covering product vulnerabilities through the Cloud VRP,” Google said.Google ChromeThe OSS VRP pause follows changes Google made in May to its Chrome and Android reward programs, in response to the growing use of AI tools for vulnerability discovery.Open Source Software Vulnerability Reward Program (OSS VRP)Google has temporarily closed its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions, saying a growing number of automated reports, most of them invalid, prompted the move.Patch Rewards ProgramResearchers can also turn to its Patch Rewards Program, which offers rewards for proactively improving the security of open source projects.

Related Articles