Skip to content

Back to the catalog

Google Partially Reverses Chrome Bug Bounty Cuts
securityweek.comarticle

Google Partially Reverses Chrome Bug Bounty Cuts

Google is raising Chrome Vulnerability Reward Program payouts for memory safety bugs. The base rate goes from $500 to $2,000, with up to $20,000 for browser, GPU and network process bugs and up to $8,000 for renderer use-after-free and memory write bugs. V8 sandbox bugs move to a flat $5,000 and V8 logic bugs to $4,000. A $2,000 fuzzer bonus returns, and submissions made after April 30, 2026 are rewarded under the new rules. The rates are still well below the pre-April 2026 levels. The article also notes that Google temporarily closed the OSS VRP to product vulnerability submissions because of a flood of AI-generated reports.

TL;DR Google quadruples Chrome bug bounty base rate for memory safety flaws to $2,000, partly reversing April cuts, and brings back a $2,000 fuzzer bonus.
Open original ↗
Document

What it is

Google has revised Chrome Vulnerability Reward Program payouts, partially undoing the April 2026 cuts. Those cuts set a $500 base reward for memory safety issues, with multipliers for reachability and exploitability, and researchers noted some rewards became 10 times smaller. The base is now $2,000. The page says rates remain well below pre-April levels.

Payout changes

CategoryReward
Memory safety base$2,000
Browser, GPU, network processup to $20,000
Renderer use-after-free / memory writeup to $8,000
V8 sandboxflat $5,000
V8 logic bugs$4,000
Non-memory-safety sandbox escapeup to $20,000
Non-memory-safety medium severity$2,000, only if the report includes or directly leads to an identified fix
Novel fuzzer bonus (reintroduced)$2,000

The summary omits the non-memory-safety rows. They matter for logic-bug researchers: sandbox escapes that don't involve memory corruption can reach the same $20,000 ceiling, and medium-severity payouts depend on supplying a fix.

What to do

  • If you hold reports submitted after April 30, 2026 that are still in the evaluation queue, Google says they will be evaluated under the new rules. Check the status of any pending reports.
  • For medium-severity non-memory bugs, include a proposed fix with the report, since that is the stated condition for the $2,000.
  • Fuzzer authors can claim the $2,000 bonus again for novel fuzzers.

Caveats

  • The page gives no exact multiplier table, so the real payout for a given bug within the ranges (for example, where a renderer bug lands under $8,000) isn't specified.
  • Google also temporarily closed the OSS VRP to product vulnerability submissions because of a flood of AI-generated reports. Don't plan on that route for now.

Organisations named here

  • Chrome Vulnerability Reward Program
  • fuzzer bonus
  • OSS VRP
  • V8 sandbox

Technologies named here

  • Google Chrome
  • Google OSS VRP
  • Chrome V8
  • Chrome
  • V8

Techniques named here

  • Memory safety vulnerabilities
  • V8 sandbox vulnerabilities and V8 logic bugs
  • Sandbox escapes not involving memory safety bugs
  • Fuzzing

Related in other