Google announced Tuesday that it’s raising bug bounty rewards for some Chrome vulnerabilities, focusing on memory safety issues.
AI has been changing the pace and profile of vulnerability discovery, and the tech giant has been adjusting its bug bounty programs in recent months.
Google significantly lowered standard payout amounts for some Chrome vulnerabilities in April to shift focus to actionable reports, with researchers noting that some rewards became 10 times smaller. At the time it announced a base reward of $500 for memory safety issues, with multipliers for reachability and the level of exploitability.
The company is now quadrupling base rates for memory safety flaws, to $2,000. Despite the increase, the new rates remain well below those offered before the April overhaul.
Vulnerabilities in Chrome’s browser, GPU and network processes can now earn researchers up to $20,000. In the case of the renderer process, bug bounty hunters can receive up to $8,000 for use-after-free and memory write bugs.
V8 sandbox vulnerabilities are moving to a flat rate of $5,000, while V8 logic bugs will be rewarded with $4,000.
As for issues not related to memory safety, medium-severity flaws will be rewarded with $2,000 if the vulnerability report includes or directly leads to an identified fix. Sandbox escapes not involving memory safety bugs can get bug bounties of up to $20,000.
Google is also reintroducing a $2,000 fuzzer bonus for developing novel fuzzers.
The company noted that “any submissions that are currently in our evaluation queue submitted after April 30th, 2026 will be evaluated and rewarded under the new payout rules.”
Google recently announced it’s temporarily closing its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions, prompted by a growing number of AI-generated reports.
Related : Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own
Related : Google Domains Impacted by Recent ccTLD Hijacks
Related : Chrome 155 Update Patches 247 Vulnerabilities
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.
Adobe Patches 140 Vulnerabilities Across 10 Products
The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge.
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites.
Critical SonicWall Vulnerability Exploited Days After Disclosure
CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.
Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.
Citrix Urges Immediate Patching of Critical NetScaler Vulnerability
The security defect, tracked as CVE-2026-107406, could lead to remote code execution or denial-of-service.
Cisco Patches a Dozen Critical Vulnerabilities
The security defects could lead to unauthorized access, information leaks, privilege escalation, DoS attacks, and remote code execution.
Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
Threat actors have started targeting CVE-2026-21589, a critical vulnerability in Atlassian’s self-hosted Data Center products.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
