Google announced Tuesday that it’s raising bug bounty rewards for some Chrome vulnerabilities, focusing on memory safety issues.
AI has been changing the pace and profile of vulnerability discovery, and the tech giant has been adjusting its bug bounty programs in recent months.
Google significantly lowered standard payout amounts for some Chrome vulnerabilities in April to shift focus to actionable reports, with researchers noting that some rewards became 10 times smaller. At the time it announced a base reward of $500 for memory safety issues, with multipliers for reachability and the level of exploitability.
The company is now quadrupling base rates for memory safety flaws, to $2,000. Despite the increase, the new rates remain well below those offered before the April overhaul.
Vulnerabilities in Chrome’s browser, GPU and network processes can now earn researchers up to $20,000. In the case of the renderer process, bug bounty hunters can receive up to $8,000 for use-after-free and memory write bugs.
V8 sandbox vulnerabilities are moving to a flat rate of $5,000, while V8 logic bugs will be rewarded with $4,000.
As for issues not related to memory safety, medium-severity flaws will be rewarded with $2,000 if the vulnerability report includes or directly leads to an identified fix. Sandbox escapes not involving memory safety bugs can get bug bounties of up to $20,000.
Google is also reintroducing a $2,000 fuzzer bonus for developing novel fuzzers.
The company noted that “any submissions that are currently in our evaluation queue submitted after April 30th, 2026 will be evaluated and rewarded under the new payout rules.”
Google recently announced it’s temporarily closing its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions, prompted by a growing number of AI-generated reports.
Related: Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own
Related: Google Domains Impacted by Recent ccTLD Hijacks
Related: Chrome 155 Update Patches 247 Vulnerabilities
