Science & Tech · Cybersecurity · 3 hrs ago
Google raises Chrome bug bounty rewards, with up to $20,000 for some flaws
Google has raised rewards for reporting Chrome security flaws.
The changes apply to its Chrome Vulnerability Rewards Program, which pays researchers who find and report bugs.
Google cut some standard rewards in April, and the new rates remain below levels offered before those cuts.
Some flaws can now earn up to $20,000, including certain memory bugs and high-impact sandbox escapes that bypass browser security barriers.
Other awards include $2,000 for medium-severity non-memory-safety issues when a report includes or leads to a fix, and a $2,000 bonus for developing a new fuzzer to uncover flaws.
The new payout rules apply immediately, including to reports submitted after April 30, 2026, that are still in Google’s evaluation queue.
Google has raised rewards for some Chrome security flaws, including payments of up to $20,000 for certain vulnerabilities.
The base reward for memory corruption vulnerabilities has quadrupled to $2,000.
Some memory-safety flaws in Chrome’s browser, network and GPU processes can earn up to $20,000.
Google has also introduced rewards of up to $20,000 for high-impact sandbox escapes that do not involve memory-safety bugs.
The updated payout rules apply immediately, including to eligible reports submitted after April 30, 2026, that remain in Google’s evaluation queue.
- Who
- Google is changing its Chrome Vulnerability Rewards Program. Security researchers can receive the rewards.
- What
- Google raised payouts for some Chrome vulnerabilities and introduced rewards for certain sandbox escapes.
- When
- The change was announced on October 13, 2026, and the new rules apply immediately.
- Where
- The changes apply to Google’s Chrome Vulnerability Rewards Program.
- Why
- Google said the program aims to identify severe, challenging vulnerabilities and improve internal testing.
This story does not have two clearly opposing sides.
Google lowered standard payouts for some Chrome vulnerabilities and set a $500 base reward for memory-safety issues.
Google announced increased rewards for some Chrome vulnerabilities.
The updated payout rules took effect.
- Memory corruption base reward
- $2,000
- Browser, network and GPU process flaws
- Up to $20,000
- Renderer process writes and use-after-free flaws
- Up to $8,000
- V8 sandbox issues
- $5,000 flat rate
- V8 logic bugs
- $4,000
- Non-memory-safety sandbox escapes
- Up to $20,000
3 sources
What people are saying
A primary goal of the Chrome VRP has always been to identify ways to improve our internal testing by understanding which vulnerabilities are the most severe and challenging to uncover
any submissions that are currently in our evaluation queue submitted after April 30th, 2026 will be evaluated and rewarded under the new payout rules