Google quadruples Chrome bug bounty base pay, offers up to $20,000 for sandbox escapes - Help Net Security
Google is updating its Chrome Vulnerability Rewards Program (Chrome VRP), increasing payments for memory corruption vulnerabilities and expanding rewards for other security flaws , fixes and research tools.
Google is updating its Chrome Vulnerability Rewards Program (Chrome VRP), increasing payments for memory corruption vulnerabilities and expanding rewards for other security flaws , fixes and research tools.
The company is introducing rewards of up to $20,000 for high-impact, non-memory-safety sandbox escapes .
Google is offering a flat $2,000 reward for non-memory-safety issues assessed as medium severity, provided the report includes or directly leads to an identified fix.
Researchers should submit reports through Google Bug Hunters and select “Chrome VRP.” Google says the new categories and rule changes will be added to the program’s rules page .
These flaws can cause software to access or modify memory incorrectly, crash the browser or allow attackers to run malicious code .
Writes, use-after-free vulnerabilities and controlled reads can earn up to $10,000.
Google is reinstating a $2,000 Chrome Fuzzer Bonus for researchers who develop and contribute novel fuzzers, which test software with unusual or unexpected inputs to uncover vulnerabilities.
The base reward for memory corruption vulnerabilities is increasing fourfold to $2,000.
In the renderer process, which processes web pages, writes and use-after-free vulnerabilities can earn up to $8,000.
Reports submitted after April 30, 2026, that remain in Google’s evaluation queue will be evaluated and rewarded under the updated framework.
What happened
Google is updating its Chrome Vulnerability Rewards Program (Chrome VRP), increasing payments for memory corruption vulnerabilities and expanding rewards for other security flaws , fixes and research tools.
The company is introducing rewards of up to $20,000 for high-impact, non-memory-safety sandbox escapes .
What changed
Google is offering a flat $2,000 reward for non-memory-safety issues assessed as medium severity, provided the report includes or directly leads to an identified fix.
Researchers should submit reports through Google Bug Hunters and select “Chrome VRP.” Google says the new categories and rule changes will be added to the program’s rules page .
Why it matters
These flaws can cause software to access or modify memory incorrectly, crash the browser or allow attackers to run malicious code .
Writes, use-after-free vulnerabilities and controlled reads can earn up to $10,000.
Technical details
Google is reinstating a $2,000 Chrome Fuzzer Bonus for researchers who develop and contribute novel fuzzers, which test software with unusual or unexpected inputs to uncover vulnerabilities.
The base reward for memory corruption vulnerabilities is increasing fourfold to $2,000.
In the renderer process, which processes web pages, writes and use-after-free vulnerabilities can earn up to $8,000.
Response
Reports submitted after April 30, 2026, that remain in Google’s evaluation queue will be evaluated and rewarded under the updated framework.
Use-after-free flaws occur when software accesses memory that has already been released.
Attribution
Help Net Security: Google is updating its Chrome Vulnerability Rewards Program (Chrome VRP), increasing payments for memory corruption vulnerabilities and expanding rewards for other security flaws , fixes and research tools.
What to watch next
Watch for updated vendor guidance and fixed-version details.