Google has quadrupled the maximum payouts for vulnerabilities found in the Chrome browser. Previously, the top reward for a critical bug was $60,000 — now it's up to $250,000. This isn't just generosity; it's a necessary move after the company cut bounties last year, leading to a sharp drop in high-quality reports from security researchers.

Why Google Made This Move

Chrome is one of the primary attack vectors for users. Vulnerabilities in the browser can allow attackers to steal data, install spyware, or take over a device. To incentivize white-hat hackers to find bugs before malicious actors do, Google launched its Vulnerability Reward Program (VRP) back in 2010. However, in 2024, the company lowered maximum payouts, sparking backlash from the community. Now, rewards have returned to their previous high levels — and in some categories, they've even increased.

What Changed in the Terms

  • Critical vulnerabilities (RCE, sandbox escape) — up to $250,000 (was $60,000).
  • High severity (security policy bypass) — up to $100,000 (was $30,000).
  • Medium severity (XSS, CSRF) — up to $30,000 (was $10,000).
  • Special bonuses for exploit chains and memory protection bypass — up to $500,000.

How It Works Under the Hood

Chrome uses a multi-layered security architecture: sandboxing, Site Isolation, Control Flow Guard (CFG), and code integrity checks. But even this system isn't perfect. Researchers look for bugs at the intersection of components — for example, a vulnerability in the V8 JavaScript engine might allow code execution in the browser context, followed by a sandbox escape via an IPC (inter-process communication) flaw. Google is willing to pay top dollar for such chains.

„Raising bounties sends a clear signal to the market: browser security is a priority. If you find a bug, don't sell it on the black market — report it to Google and get paid legally,“ comments a cybersecurity expert.

What Regular Users Should Do

While researchers hunt for bugs, you should make sure your Chrome is updated to the latest version. Google releases patches roughly every two weeks, and many critical vulnerabilities are fixed before they become public knowledge. It's also wise to enable automatic updates and keep Safe Browsing protection active.

If you want to try finding vulnerabilities yourself, check out Google's VRP program. Start with simple bugs (like XSS in extensions) and gradually move to more complex ones. Each confirmed report pays from $500 to $250,000.