Google Now Offers Up to $20,000 for Finding Chrome Security Bugs

Base rewards for memory bugs have quadrupled, and the bounty for discovering Chrome security bugs has reached $20,000.

The base reward for memory bugs has quadrupled and the reward for discovering Chrome security bugs has reached $20,000.

Become a special member of Arjan Ambassador in order to benefit from and access special facilities and different departments in Arjan Ambassador.

Google relies on reports from security researchers, along with its own internal security teams, to keep apps like the Chrome browser safe from security exploits. The company has made several changes to its "Vulnerability Reward Program" (VRP) over the past months, including reducing Chrome's reward amounts in May and using artificial intelligence to improve the browser's security in July. Now the company has made another new change to the Chrome VRP program.

According to a new Google blog post, the company has quadrupled the base reward amount for "memory corruption" vulnerabilities to $2,000. Additionally, reports of Controlled Reads and crashes in browser, GPU, and network processes will now receive a $4,000 reward. On the other hand, the amount paid for Controlled Writes can increase up to $20,000.

Meanwhile, the rewards for "Use-After-Free" vulnerabilities in the Renderer Process (a type of memory management error where the program tries to access a section of memory again after erasing it) have also been increased to $8,000. Google has also simplified the reward rate for V8 engine sandbox issues and V8 logic bugs, setting them at a fixed rate of $5,000 and $4,000, respectively.

To further improve Chrome's security and encourage researchers to look beyond critical memory vulnerabilities, Google has also introduced rewards for fixing moderate-severity issues. The company is offering a $2,000 reward for all security issues unrelated to memory safety that are of moderate severity, and rewards up to $20,000 for high-impact bugs.

Google has also announced that it has brought back the $2,000 Chrome Fuzzer Bonus. "Fuzzing" is a security testing technique in which invalid, unexpected, and manipulated inputs are purposefully given to software in order to discover its security vulnerabilities. By reviving this reward, Google intends to reward researchers who create specialized and innovative fuzzer tools for Chrome.

Finally, the company has introduced new year-end awards to recognize contributions from the security community, including categories such as "Most Discoveries," "Best Bug," and "Best Report." As a special bonus, Google has confirmed that if you have submitted a vulnerability report after April 30, 2026 (10 May 2026) and the report is still in the evaluation queue, the reward will be calculated and awarded based on the new payment structure.

My professional career in the world of technology goes back almost 10 years; The path that started with hardware, continued with software, and now continues as a technology reporter in Sefir Arjan. I am Javad and more than three decades have passed and in addition to the world of technology, I love movies and cinema, classic rock music and Real Madrid.