Google quadruples Chrome bug bounty base pay, offers up to $20,000 for sandbox escapes - Help Net Security

Google quadruples Chrome bug bounty base pay, offers up to $20,000 for sandbox escapes

Google is updating its Chrome Vulnerability Rewards Program (Chrome VRP), increasing payments for memory corruption vulnerabilities and expanding rewards for other security flaws, fixes and research tools.

“A primary goal of the Chrome VRP has always been to identify ways to improve our internal testing by understanding which vulnerabilities are the most severe and challenging to uncover,” the company said.

Higher payments for memory corruption bugs

The base reward for memory corruption vulnerabilities is increasing fourfold to $2,000. These flaws can cause software to access or modify memory incorrectly, crash the browser or allow attackers to run malicious code.

In Chrome’s browser, network and GPU processes, rewards range from up to $4,000 for reads and crashes to up to $20,000 for controlled memory writes demonstrated from web content. Writes, use-after-free vulnerabilities and controlled reads can earn up to $10,000.

In the renderer process, which processes web pages, writes and use-after-free vulnerabilities can earn up to $8,000. Use-after-free flaws occur when software accesses memory that has already been released. V8 sandbox issues will receive a flat rate of $5,000, while V8 logic bugs will earn $4,000.

Rewards for medium-severity fixes and sandbox escapes

Google is offering a flat $2,000 reward for non-memory-safety issues assessed as medium severity, provided the report includes or directly leads to an identified fix.

The company is introducing rewards of up to $20,000 for high-impact, non-memory-safety sandbox escapes. These vulnerabilities bypass the security barrier designed to contain browser components.

Fuzzer bonus and year-end recognition

Google is reinstating a $2,000 Chrome Fuzzer Bonus for researchers who develop and contribute novel fuzzers, which test software with unusual or unexpected inputs to uncover vulnerabilities.

Submission guidelines and intake procedures will be published in the Chrome VRP FAQ in collaboration with the Chrome Fuzzing team.

The company plans discretionary year-end awards to recognize contributions such as the most findings, best report and best bug.

When the new rules apply

The new payout rules apply immediately. Reports submitted after April 30, 2026, that remain in Google’s evaluation queue will be evaluated and rewarded under the updated framework.

Researchers should submit reports through Google Bug Hunters and select “Chrome VRP.” Google says the new categories and rule changes will be added to the program’s rules page.