Google Overhauls Chrome Vulnerability Reward Program With Quadrupled Base Bounties
Google relies heavily on external security researchers alongside its internal security teams to defend Chrome against active exploit attacks. Over the past several months, the company has introduced multiple adjustments to its bug bounty framework. Specifically, Google reduced certain payouts in May before deploying artificial intelligence tools in July to bolster browser defenses. Now, the company is rolling out a comprehensive overhaul to the Chrome Vulnerability Reward Program (VRP).
Quadrupled Memory Corruption Bounties and V8 Payouts
In an official blog post, Google unveiled restructured reward tiers and updated vulnerability classifications. Notably, the baseline payout for memory corruption bugs has quadrupled to $2,000. Furthermore, reports detailing controlled read or crash vulnerabilities within the browser, graphics processing unit (GPU), or network processes now earn $4,000. Meanwhile, controlled write vulnerabilities command bounties of up to $20,000.
Simultaneously, Google increased rewards for write vulnerabilities and use-after-free (UAF) flaws inside the renderer process to a maximum of $8,000. The company also simplified its payout structure for V8 JavaScript engine flaws. Consequently, V8 sandbox escapes and V8 logic bugs now carry fixed rewards of $5,000 and $4,000, respectively.
New Medium-Severity Tiers and Fuzzing Bonuses
To encourage security researchers to look beyond high-severity memory flaws, Google introduced new rewards for medium-severity patches. Under the updated guidelines, all non-memory medium-severity vulnerabilities qualify for a $2,000 bounty. Additionally, high-impact non-memory flaws can earn researchers up to $20,000.
Moreover, Google announced the return of the $2,000 Chrome Fuzzing Bonus. Fuzzing is an automated software testing technique that feeds malformed, unexpected data inputs into a target program to uncover hidden security flaws. By reinstating this bonus, Google aims to incentivize researchers who develop novel, dedicated fuzzing tools tailored specifically for Chrome.
Annual Community Awards and Retroactive Eligibility
Finally, Google established new year-end awards to recognize outstanding contributions from the broader security community. These honors include accolades for the “Most Bugs Found,” the “Best Bug,” and the “Best Report.”
Researchers can review the complete list of updated categories, eligibility rules, and payout tables on the official VRP rules page. Crucially, Google confirmed that any vulnerability report submitted after April 30, 2026, that remains in the active triage queue will automatically be evaluated under the new reward structure.
