Google Partially Reverses Chrome Bug Bounty Cuts

* Google raised bug bounty rewards for some Chrome vulnerabilities focusing on memory safety issues.
* In April, standard payout amounts for some Chrome vulnerabilities were significantly lowered.
* A base reward of $500 was announced for memory safety issues, with multipliers for exploitability and reachability.
* New base rates for memory safety flaws are set at $2,000.
* Vulnerabilities in Chrome’s browser, GPU, and network processes can earn up to $20,000.
* Use-after-free and memory write bugs in the renderer process can result in up to $8,000.
* V8 sandbox vulnerabilities are rewarded at a flat rate of $5,000.
* V8 logic bugs will be rewarded with $4,000.
* Medium-severity flaws that include or lead to an identified fix earn $2,000.
* A $2,000 fuzzer bonus is reintroduced for developing novel fuzzers.
* Submissions in the evaluation queue submitted after April 30th, 2026, will be evaluated under new rules.
* Google temporarily closed its Open Source Software Vulnerability Reward Program (OSS VRP) for product vulnerability submissions due to AI-generated reports.

The shift in reward structure reflects a strategic realignment of focus, attempting to modulate the flow of security research by incentivizing specific types of reporting over sheer volume. The move from broad, lower initial payouts to higher, targeted rates for memory safety vulnerabilities suggests an attempt to steer researchers toward finding deeply systemic flaws that require significant remediation effort, rather than chasing numerous low-severity issues. This dynamic is compounded by the acknowledgment of AI's impact on discovery, leading to a system adjustment where monetary incentives are being recalibrated in response to evolving threat landscapes and automated analysis. The reintroduction of the fuzzer bonus indicates an attempt to foster novel tooling development, suggesting that the value placed on discovery is now shifting from mere disclosure to active, creative mitigation strategies. The simultaneous closure of the OSS VRP for product submissions signals a tension between incentivizing external research and managing the integrity of internally generated or AI-influenced data streams. The central tension lies in balancing the need to attract high-value security talent with the operational realities of managing complex, evolving vulnerability disclosures, forcing a re-examination of what constitutes valuable security intelligence when large language models become a factor in the discovery process.
Bridge Questions: How does this recalibration affect the diversity of vulnerabilities that are prioritized for disclosure? What is the long-term effect on the ecosystem when incentives for reporting are directly tied to specific technical vectors like memory safety? How should the incentive structure evolve to best account for discoveries made by automated systems versus human researchers?