Google has announced changes to its Chrome Vulnerability Rewards Program, with rewards up to $20,000 (roughly Rs 19 lakh) for uncovering security bugs and vulnerabilities in the company’s internet browser. In a Bug Hunters blog post, Google said it is adjusting reward amounts and categories to increase rewards for deep security research, high-value fixes and more.
Chrome announced it is quadrupling the base rates for identifying memory safety vulnerabilities. The company noted it is increasing the base reward for flagging memory corruption vulnerabilities to $2,000 (around Rs 1.9 lakh). For flagging issues in browser, network and GPU process reads, updated payouts range from $4,000 (about Rs 3.8 lakh). Plus, up to $20,000 (nearly Rs 1.9 lakh) is being offered for “controlled writes demonstrated from web contents.”
Payouts for writes and use-after-frees (UAF) have increased up to $8,000 (roughly Rs 7.6 lakh). Finding V8 sandbox and logic bugs can give you $5,000 (about Rs 4.75 lakh) and $4,000 (nearly Rs 3.8 lakh) in payouts. For medium severity (S2) non-memory safety issues, a $2,000 reward is available. For sandbox escapes (also non-memory safety), the company introduced rewards up to $20,000 for high-impact issues.
Google also said it is reviving the $2,000 Chrome Fuzzer Bonus for researchers contributing to novel fuzzers. The brand noted it will also implement new “discretionary” year-end rewards across categories such as “Most Findings”, “Best Report”, “Best Bug” and more. According to VRP rules, rewards apply to finding flaws in Chrome’s Android, iOS, Windows, macOS, Linux and more versions.
The blog post also noted that a submitted report after April 30 (2026) that remains in the evaluation queue shall be rewarded in accordance with the new rules. The update can be viewed as Google’s attempt to make the widely popular Chrome a safer internet browser. Plus, incentivising researchers and bug hunters to report bugs can help ensure these security flaws are reported to the company before they are exploited at a large scale by hackers. To fix issues, the company issues regular over-the-air (OTA) software updates.