Google Increases Android Bug Bounty to $1.5M Amid AI Exploit Challenges
Severity: Low (Score: 36.9)
Sources: security.googleblog.com, Bleepingcomputer, Securityaffairs.Co
Summary
Google has revamped its Vulnerability Reward Programs (VRP) for Android and Chrome, announcing bounties of up to $1.5 million for complex exploits, particularly targeting zero-click vulnerabilities in the Pixel Titan M2 security chip. This change reflects a strategic shift due to the impact of artificial intelligence on vulnerability discovery, leading to reduced payouts for simpler exploits. The new Android program will focus on Linux kernel vulnerabilities in Google-maintained components, while the Chrome program emphasizes concise reports over lengthy analyses. In 2025, Google paid out a record $17.1 million to researchers, and the total since 2010 has surpassed $81.6 million. Despite lowering some individual rewards, Google anticipates an increase in total payouts for 2026. The restructuring aims to enhance collaboration with the research community and address the evolving landscape of cybersecurity threats, particularly those that AI can exploit. A wave of new exploits is expected as AI continues to evolve. Key Points: • Google raises Android bug bounty to $1.5 million for complex exploits. • Payouts for simpler vulnerabilities are reduced due to AI advancements. • Total bug bounty payouts reached $17.1 million in 2025, with expectations for 2026 to rise.
Key Entities
- Zero-day Exploit (attack_type)
- Android (platform)
- Linux (platform)
- Pixel Titan M2 (platform)
- Chrome (tool)