Google will pay you up to $20,000 for Chrome security bugs

Google has relied on vulnerability reports from security researchers alongside its own internal security teams to keep apps like Chrome secure against exploits. The company has made several changes to its Vulnerability Rewards Program (VRP) over the last few months, including reducing Chrome reward payouts in May and using AI to improve Chrome security in July. Now, the company is making further adjustments to the Chrome VRP.

In a blog post, the company announces new reward amounts and categories. Google has quadrupled the base reward amount for memory corruption vulnerabilities to $2,000. Furthermore, reports for controlled reads and crashes in the browser, GPU, and network processes will now earn rewards of $4,000. Payouts for controlled writes, on the other hand, can go up to $20,000.

Meanwhile, payouts for writes and use-after-free (UAF) vulnerabilities in the renderer process have been increased to up to $8,000. Google is simplifying reward rates for V8 sandbox issues and V8 logic bugs to a flat rate of $5,000 and $4,000, respectively.

New reward categories and a return of the Chrome Fuzzer Bonus

To further improve Chrome security and encourage research beyond critical memory vulnerabilities, the company is introducing rewards for medium-severity fixes. It will offer a $2,000 reward for all medium-severity, non-memory safety issues, alongside rewards of up to $20,000 for high-impact bugs.

Google also announces that it is bringing back the $2,000 Chrome Fuzzer Bonus. Fuzzing is a security testing technique that feeds intentionally malformed and unexpected inputs into the target software to discover security vulnerabilities. By reintroducing this bonus, Google aims to reward researchers building specialized, novel fuzzers for Chrome.

Finally, he company is introducing new end-of-year awards to celebrate submissions from the security community, featuring categories such as “Most Findings,” “Best Bug,” and “Best Report.”

For a detailed look at the updated categories, rules, and rewards, you can check the updated VRP Rules page. As an added bonus, if you submitted a vulnerability report after April 30, 2026, and it is still in the evaluation queue, Google confirmed it will be rewarded under the new payout structure.