Google restores part of April's Chrome bounty cut with a $2,000 memory-bug base
Google quadrupled the Chrome VRP base reward for memory corruption bugs to $2,000, up from the $500 it set in April. SecurityWeek reports the new rates are still well below those paid before April, so the change restores part of a cut.
The Watch · Security desk
Under the new Chrome rules, controlled memory writes shown from web content in the browser, network or GPU process earn up to $20,000. Renderer writes and use-after-free bugs earn up to $8,000. Reads and crashes in the browser, network or GPU process earn up to $4,000.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Controlled memory write, browser, network or GPU | $20,000 up to | 2 | |
| Renderer writes, use-after-free | $8,000 up to | renderer process | 3 |
| Reads and crashes | $4,000 up to | browser, network and GPU processes | 2 |
What happened
- Google also introduced rewards of up to $20,000 for high-impact sandbox escapes that do not involve memory safety bugs.
- A $2,000 Chrome Fuzzer Bonus returns for researchers who contribute novel fuzzers.
- The rules apply immediately, and reports filed after April 30, 2026 that are still in the evaluation queue will be paid under them.
Why it matters
- Who has to decide decision A researcher choosing where to hunt now sees up to $20,000 for a controlled write outside the renderer and up to $8,000 inside it, a 2.5x gap.
- What it costs cost Google pays the higher schedule on its backlog: every pending report filed after April 30 is repriced upward without resubmission.
- What it sets up precedent Google moved Chrome rewards down in April and partly back up now, and it closed its OSS VRP to product reports, so AI-driven report volume is shaping payout design in both directions.
Next story · Security · 2d ago
XBOW built a Windows Chrome exploit chain in six days with about $40,000 of AI computeConfirmed4 publishers
The base moves from $500 to $2,000, a $1,500 increase [16]. SecurityWeek reports that the new rates remain well below those offered before the April overhaul [18], and that researchers noted some rewards became 10 times smaller when Google made the cut [12].
The schedule pays by where the bug sits. A controlled memory write demonstrated from web content in the browser, network or GPU process can earn up to $20,000 [2]. Writes and use-after-free bugs in the renderer top out at $8,000 [3], which is 2.5 times less [17]. V8 sandbox issues get a flat $5,000 and V8 logic bugs $4,000 [4]. Google also lists up to $20,000 for high-impact sandbox escapes that do not involve memory safety [6].
The April cut was meant to shift focus to actionable reports [11]. SecurityWeek says AI has been changing the pace and profile of vulnerability discovery, and that Google has been adjusting its bounty programs in recent months [13]. Google also temporarily closed its Open Source Software VRP to product vulnerability submissions, prompted by a growing number of AI-generated reports [14].
"A primary goal of the Chrome VRP has always been to identify ways to improve our internal testing by understanding which vulnerabilities are the most severe and challenging to uncover," the company said [15].
The new rules apply immediately [8]. Google said "any submissions that are currently in our evaluation queue submitted after April 30th, 2026 will be evaluated and rewarded under the new payout rules" [9]. A researcher with a pending report from that window is repriced upward without resubmitting.
What to watch
- Google adding the new categories to the Chrome VRP rules page, which would settle how the flat and tiered rates are defined.
- Publication of the Chrome VRP FAQ with fuzzer bonus submission guidelines, which would show what counts as a novel fuzzer.
- Any further Chrome rate changes that move the base reward back toward pre-April levels.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence68
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Google increased the base reward for Chrome VRP memory corruption vulnerabilities fourfold, to $2,000.
- [2]
In Chrome's browser, network and GPU processes, rewards range from up to $4,000 for reads and crashes to up to $20,000 for controlled memory writes demonstrated from web content.
- [3]
In the renderer process, writes and use-after-free vulnerabilities can earn up to $8,000.
- [4]
V8 sandbox issues receive a flat rate of $5,000 and V8 logic bugs earn $4,000.
- [5]
Google offers a flat $2,000 reward for non-memory-safety issues assessed as medium severity, provided the report includes or directly leads to an identified fix.
- [6]
Google is introducing rewards of up to $20,000 for high-impact, non-memory-safety sandbox escapes.
- [7]
Google is reinstating a $2,000 Chrome Fuzzer Bonus for researchers who develop and contribute novel fuzzers.
- [8]
The new payout rules apply immediately, and reports submitted after April 30, 2026 that remain in Google's evaluation queue will be evaluated and rewarded under the updated framework.
- [9]
Google noted that "any submissions that are currently in our evaluation queue submitted after April 30th, 2026 will be evaluated and rewarded under the new payout rules."
- [10]
Google says the new categories and rule changes will be added to the Chrome VRP rules page, and submission guidelines for the fuzzer bonus will be published in the Chrome VRP FAQ.
- [11]
In April Google lowered standard payouts for some Chrome vulnerabilities to shift focus to actionable reports, announcing a $500 base reward for memory safety issues with multipliers for reachability and exploitability.
- [12]
Researchers noted that some Chrome rewards became 10 times smaller after the April overhaul.
- [13]
AI has been changing the pace and profile of vulnerability discovery, and Google has been adjusting its bug bounty programs in recent months.
- [14]
Google recently announced it is temporarily closing its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions, prompted by a growing number of AI-generated reports.
- [15]
"A primary goal of the Chrome VRP has always been to identify ways to improve our internal testing by understanding which vulnerabilities are the most severe and challenging to uncover," Google said.
- [16]
The base reward rose by $1,500, from $500 to $2,000.
- [17]
The top browser, network and GPU process reward ($20,000) is 2.5 times the renderer cap for writes and use-after-free bugs ($8,000).
- [18]
Despite the increase, the new Chrome rates remain well below those offered before the April overhaul.
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comGoogle quadruples Chrome bug bounty base pay, offers up to $20,000 for sandbox escapes
1 article · October 13, 2026
- securityweek.comGoogle Partially Reverses Chrome Bug Bounty Cuts
1 article · October 13, 2026
Topics and entities
Topics
- Browser security
- Bug Bounty Programs
- Memory Safety
- AI-Generated Vulnerability Reports
Entities
- Google Chrome
- Chrome Vulnerability Rewards Program
- Google Open Source Software Vulnerability Reward Program
- V8