- Google raised Chrome's base reward for memory safety flaws from $500 to $2,000, SecurityWeek reported, though rates remain well below those paid before April.
- A bounty is a price list. It tells researchers which reports a vendor wants, and Google has now changed that list twice this year.
- Leaders who run a bounty or accept vulnerability reports should check that their rules pay for reports that are usable and ready to fix.
A bug bounty is a price list. What a company pays for tells outside researchers what to send it. Google has now changed the Chrome price list twice this year. Read alongside the fix-linked and fuzzer rewards, the changes suggest how a vendor may weigh which reports are worth its time.
What Google changed
SecurityWeek reported on October 13 that Google is raising rewards for some Chrome vulnerabilities, with a focus on memory safety issues. In April, Google had cut standard payouts to shift attention to actionable reports. Researchers noted that some rewards became 10 times smaller. The April base reward for memory safety flaws was $500, with multipliers for reachability and exploitability.
The base is now four times higher. SecurityWeek says it still sits well below what Google paid before April. Flaws in Chrome's browser, GPU and network processes can earn up to $20,000. Renderer bugs of the use-after-free and memory write type can earn up to $8,000. Flaws in the sandbox of V8, Chrome's JavaScript engine, now pay a flat $5,000. V8 logic bugs pay $4,000.
What these bugs are
Memory safety bugs let an attacker make a program misuse its own memory. A use-after-free means the program keeps using memory it already released. A memory write bug lets an attacker overwrite data they should not touch.
The renderer is the part of Chrome that draws web pages. Chrome confines it in a sandbox, a restricted area meant to contain damage. A sandbox escape breaks out of that area. The reward tiers are consistent with a vendor paying the most for flaws in the browser, GPU and network processes, and for escapes that do not depend on memory bugs. Google's announcement, as SecurityWeek reports it, lists the amounts but does not explain the tiers.
The new rules also pay for non-memory flaws, with a condition. Medium-severity bugs earn $2,000 if the report includes a fix or directly leads to one. Google is also bringing back a $2,000 bonus for building novel fuzzers, tools that feed odd inputs to software to make it fail.
The price is a filter
Here is the lesson. When bugs can be found faster, a reward schedule works less like a thank-you and more like intake control. Pay for the right shape of report and you get more of them. Pay for everything and you may get a queue no one can read.
SecurityWeek sets the changes against the growing role of AI in finding vulnerabilities. It also reports that Google recently closed its Open Source Software Vulnerability Reward Program to product vulnerability submissions, temporarily, after a rise in AI-generated reports. That is a separate program. The source does not say AI drove the Chrome changes.
The people on the other side of the price list feel every change. Researchers noted that some rewards became 10 times smaller. For a researcher, a reward that is 10 times smaller changes whether the work is worth doing. Google says queued submissions made after April 30, 2026 will be judged under the new rules.
What the report does not tell us
The source gives no figures on report volume before or after the April change. It does not say why Google raised rates now. It does not show whether researchers sent fewer or better reports. One vendor's two adjustments are not a trend across the industry.
Questions for your team
Most companies are not Google. Many still accept vulnerability reports, run a disclosure inbox or pay a bounty through a platform. Five questions are worth asking.
First, what does our program pay for, and does that match the reports we can actually act on? Second, do we reward a report that arrives with a fix, or only one that finds a flaw? Third, how do we triage reports written by AI tools, and who decides? Fourth, when we change rules, what happens to reports already in the queue? Fifth, who owns the answer when a researcher asks why a payout changed?
A price list is a policy. Google's two changes this year show a vendor adjusting it in public. Review yours before the queue forces you to.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: SecurityWeek.
