Google has updated its Chrome Vulnerability Reward Program, effective immediately. The company increased the base reward for memory corruption vulnerabilities from $500 to $2000. Proven controlled write vulnerabilities in browser, network, and GPU processes now qualify for top payouts of up to $20 000.
The new structure sets specific caps for different vulnerability types. Read or crash issues in browser, network, and GPU processes earn up to $4000, while write and use-after-free flaws reach $10 000. Controlled reads in these areas are capped at $10 000. For renderer processes, write and use-after-free bugs are eligible for up to $8000.
V8 engine sandbox vulnerabilities are now set at $5000, with logic flaws at $4000. Other sandboxed processes offer $2000 for read or crash issues and $3000 for write or use-after-free bugs. Google mandates that reports must be reproducible on its infrastructure to qualify for full awards; otherwise, payouts may be limited to the base amount.
The program now includes rewards for non-memory safety issues. Medium-severity S2 problems that include a fix or lead to one can earn $2000. High-impact non-memory sandbox escapes are eligible for up to $20 000. Additionally, Google restored the $2000 Chrome Fuzzer Bonus for new fuzzer development and introduced annual community awards.
