Vulnerabilities
Google Partially Reverses Chrome Bug Bounty Cuts
Google is restructuring bug bounty rewards with a focus on complex memory safety vulnerabilities.
By
|
October 13, 2026 (1:00 PM ET)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Google Partially Reverses Chrome Bug Bounty Cuts https://www.securityweek.com/google-partially-reverses-chrome-bug-bounty-cuts/) [+ Whatsapp](whatsapp://send?text=Google Partially Reverses Chrome Bug Bounty Cuts https://www.securityweek.com/google-partially-reverses-chrome-bug-bounty-cuts/) + Email
Google announced Tuesday that it’s raising bug bounty rewards for some Chrome vulnerabilities, focusing on memory safety issues.
AI has been changing the pace and profile of vulnerability discovery, and the tech giant has been adjusting its bug bounty programs in recent months.
Google significantly lowered standard payout amounts for some Chrome vulnerabilities in April to shift focus to actionable reports, with researchers noting that some rewards became 10 times smaller. At the time it announced a base reward of $500 for memory safety issues, with multipliers for reachability and the level of exploitability.
The company is now quadrupling base rates for memory safety flaws, to $2,000. Despite the increase, the new rates remain well below those offered before the April overhaul.
Vulnerabilities in Chrome’s browser, GPU and network processes can now earn researchers up to $20,000. In the case of the renderer process, bug bounty hunters can receive up to $8,000 for use-after-free and memory write bugs.
V8 sandbox vulnerabilities are moving to a flat rate of $5,000, while V8 logic bugs will be rewarded with $4,000.
Advertisement. Scroll to continue reading.
As for issues not related to memory safety, medium-severity flaws will be rewarded with $2,000 if the vulnerability report includes or directly leads to an identified fix. Sandbox escapes not involving memory safety bugs can get bug bounties of up to $20,000.
Google is also reintroducing a $2,000 fuzzer bonus for developing novel fuzzers.
The company noted that “any submissions that are currently in our evaluation queue submitted after April 30th, 2026 will be evaluated and rewarded under the new payout rules.”
Google recently announced it’s temporarily closing its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions, prompted by a growing number of AI-generated reports.
Related : Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own
Related : Google Domains Impacted by Recent ccTLD Hijacks
Related : Chrome 155 Update Patches 247 Vulnerabilities
Written By
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Eduard Kovacs
- Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
- Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
- Adobe Patches 176 Vulnerabilities Across 11 Products
- Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
- Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns
- Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
- Canonical Websites Disrupted in Second DDoS Attack This Year
- Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Latest News
- AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds
- ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw
- Harmonic Security Raises $50 Million for Workforce AI Protection
- Virtual Event Today: Zero Trust Strategies Summit
- Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
- US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms
- Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
- Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
Trending
iRhythm Data Breach Impacts at Least 360,000 People
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems
Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns
US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward
Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
Adobe Patches 176 Vulnerabilities Across 11 Products
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
## Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
## Virtual Event: Zero Trust & Identity Strategies Summit 2026
October 14, 2026
Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.
People on the Move
Adam Zolle has joined Nike as CISO.
Jeff Hackett has been appointed CFO at internet intelligence provider Censys.
Accenture Federal Services has named Nathaniel Parker as CISO.
Expert Insights
## AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)
## Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)
## Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)
## “We Think the Security Control Is Working” Is No Longer Good Enough
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)
## This Key Will Self-Destruct: An Open Standard for Revocable API Keys
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Google Partially Reverses Chrome Bug Bounty Cuts https://www.securityweek.com/google-partially-reverses-chrome-bug-bounty-cuts/) [+ Whatsapp](whatsapp://send?text=Google Partially Reverses Chrome Bug Bounty Cuts https://www.securityweek.com/google-partially-reverses-chrome-bug-bounty-cuts/) + Email
Popular Topics
Security Community
- Virtual Cybersecurity Events
- Webcast Library
- CISO Forum
- AI Risk Summit
- ICS Cybersecurity Conference
- Cybersecurity Newsletters
Stay Intouch
About SecurityWeek
News Tips
Got a confidential news tip? We want to hear from you.
Advertising
Reach a large audience of enterprise cybersecurity professionals
Daily Briefing Newsletter
Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.
Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.