Google Quadruples Chrome Bug Bounties to $2,000 and Offers Up to $20,000 for Security Vulnerabilities

Google is raising the stakes for security researchers hunting vulnerabilities in Chrome. The company has overhauled its Chrome Vulnerability Reward Program, increasing memory safety payouts, adding new reward categories, and bringing back a bonus for researchers developing new fuzzers. The changes comes at a time when AI is increasingly helping Google identify security flaws internally. Now, the company wants researchers to focus on deep security issues that automated tools might miss.

Google raises Chrome vulnerability rewards to $20,000

Google has quadrupled the base reward for memory corruption vulnerabilities to $2,000. Researchers can earn up to $20,000 for controlled writes demonstrated from web content in Chrome’s browser, network, and GPU processes.

Renderer vulnerabilities also receive updated payouts. Writes and use-after-free issues can earn up to $8,000, while V8 sandbox issues carry a flat $5,000 reward. V8 logic bugs qualify for $4,000. Google is also expanding rewards beyond memory corruption. Medium-severity non-memory safety vulnerabilities now qualify for $2,000 when reports include or directly lead to an identified fix.

Meanwhile, researchers who uncover high-impact sandbox escapes unrelated to memory safety can earn up to $20,000. Google says these changes are designed to recognize valuable security work across more vulnerability categories. For those unaware, Google previously adjusted its Chrome bug bounty rules for the AI era, shifting attention toward reproducible issues and actionable reports.

Chrome brings back its $2,000 fuzzer bonus

Fuzzing researchers have another reason to contribute. Google is bringing back its $2,000 Chrome Fuzzer Bonus for researchers who develop and contribute novel fuzzers. The company is also introducing discretionary year-end awards. Categories could include Most Findings, Best Report, and Best Bug, giving researchers additional recognition.

These changes follow a busy period for Chrome security. Google recently patched 230 vulnerabilities in Chrome. Researchers must submit reports through Google Bug Hunters and select Chrome VRP. More importantly, eligible submissions already awaiting evaluation, if submitted after April 30, 2026, will be assessed under the new payout rules.