Google has updated its Chrome Vulnerability Reward Program (VRP), increasing payouts for security researchers and introducing new categories for bug reports. The company has also reinstated the Chrome Fuzzer Bonus, offering an additional $2000 for developers who create specialized testing tools.
Base rewards for memory corruption vulnerabilities have quadrupled to $2000. For controlled data reads and process crashes in the browser, GPU, or network, researchers can now receive $4000, while controlled data writes are eligible for up to $20 000. Use-after-free and page rendering write errors now carry an $8000 reward.
New fixed payouts have been set for V8 sandbox issues and logical errors in the JavaScript engine, at $5000 and $4000 respectively. Non-memory-related medium-severity vulnerabilities are now eligible for $2000, while critical bugs remain capped at $20 000.
The company is introducing annual awards for the most findings, best bug, and best report. Submissions made after April 30, 2026, that are still pending review will be evaluated under the new payment structure. Meanwhile, Google has suspended bug reports for open-source software.
