Back Securityweek

Google Partially Reverses Chrome Bug Bounty Cuts

Securityweek •Eduard Kovacs • October 13, 2026

Google announced Tuesday that it’s raising bug bounty rewards for some Chrome vulnerabilities, focusing on memory safety issues.

AI has been changing the pace and profile of vulnerability discovery, and the tech giant has been adjusting its bug bounty programs in recent months.

Google significantly lowered standard payout amounts for some Chrome vulnerabilities in April to shift focus to actionable reports, with researchers noting that some rewards became 10 times smaller. At the time it announced a base reward of $500 for memory safety issues, with multipliers for reachability and the level of exploitability.

The company is now quadrupling base rates for memory safety flaws, to $2,000. Despite the increase, the new rates remain well below those offered before the April overhaul.

Vulnerabilities in Chrome’s browser, GPU and network processes can now earn researchers up to $20,000. In the case of the renderer process, bug bounty hunters can receive up to $8,000 for use-after-free and memory write bugs.

V8 sandbox vulnerabilities are moving to a flat rate of $5,000, while V8 logic bugs will be rewarded with $4,000.

As for issues not related to memory safety, medium-severity flaws will be rewarded with $2,000 if the vulnerability report includes or directly leads to an identified fix. Sandbox escapes not involving memory safety bugs can get bug bounties of up to $20,000.

Google is also reintroducing a $2,000 fuzzer bonus for developing novel fuzzers.

The company noted that “any submissions that are currently in our evaluation queue submitted after April 30th, 2026 will be evaluated and rewarded under the new payout rules.”

Google recently announced it’s temporarily closing its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions, prompted by a growing number of AI-generated reports.

Related : Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own

Related : Google Domains Impacted by Recent ccTLD Hijacks

Related : Chrome 155 Update Patches 247 Vulnerabilities

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google Increases Chrome Bug Bounty Rewards Amid AI-Driven Vulnerability Discovery On October 13, 2026, Google announced an increase in bug bounty rewards for certain Chrome vulnerabilities, particularly focusing on memory safety issues. This change comes after significant cuts to the bug bounty program in April 2026, where base rewards for some vulnerabilities were reduced by up to 90%. The new base reward for memory safety flaws has been raised from $500 to $2,000, though this is still below pre-April levels. Researchers can earn up to $20,000 for vulnerabilities in Chrome's browser, GPU, and network processes. The company is also reintroducing a $2,000 bonus for novel fuzzers. This adjustment follows a surge in AI-generated vulnerability reports, prompting Google to temporarily close its Open Source Software Vulnerability Reward Program for product submissions. The changes aim to encourage more actionable reports from security researchers. 3 sources 31

Extracted Entities

Tools (1)

Google Chrome