GOOGLE has restructured its Chrome Vulnerability Reward Program (VRP), with immediate effects aimed at memory corruption flaws in Chrome. The baseline bounty for memory corruption has been quadrupled from $500 to $2,000, and researchers who demonstrate controlled write exploits within browser, network, or GPU processes can earn up to $20,000.
The updated scheme introduces tiered payouts based on vulnerability class and impact. Simple read or crash flaws in browser, network, and GPU processes can yield up to $4,000, while standard write and use-after-free weaknesses command up to $10,000. A proven controlled read is worth $10,000, and a validated controlled write can reach the $20,000 maximum. For renderer processes, write and use-after-free bugs now pay up to $8,000.
V8 engine sandbox escapes carry a flat $5,000, while V8 logic flaws are worth $4,000; other sandboxed processes pay $2,000 for read or crash and $3,000 for write and use-after-free.
A notable stipulation is that all memory safety reports must reproduce reliably on Google’s internal infrastructure; submissions without a compatible testing environment may receive only the baseline. The VRP also introduces new medium-severity non-memory rewards, including a $2,000 bounty for S2-class bugs that include a viable patch or direct remediation. The program also reinstates a $2,000 Chrome Fuzzer Bonus and adds annual community awards to recognise notable reports.