Google has updated its Chrome Vulnerability Reward Program (VRP) with a new structure for payouts and vulnerability classifications. The company increased the base reward for memory corruption vulnerabilities to $2,000, which is four times the previous amount. Reports concerning controllable read and crash vulnerabilities in the browser, GPU, or network processes are now eligible for $4,000, while controllable write vulnerabilities can earn up to $20,000.
The program now offers up to $8,000 for write vulnerabilities and use-after-free (UAF) issues within the rendering process. Google has also standardized rewards for V8 sandbox and V8 logic flaws at $5,000 and $4,000, respectively. To encourage broader research, the company introduced a $2,000 reward for medium-severity non-memory safety vulnerabilities, with high-impact flaws eligible for up to $20,000.
Additionally, Google reinstated a $2,000 bonus for fuzzing, specifically rewarding researchers who develop new, specialized fuzzing tools for Chrome. The company also established annual awards to recognize community contributions, including categories for the most vulnerabilities found, the best vulnerability, and the best report. These new standards will apply to reports submitted and pending in the review queue after April 30, 2026.
