Google Pays $100,000 in Rewards for Two Chrome Vulnerabilities

Google has released Chrome 142 to the stable channel with patches for 20 vulnerabilities, four of which are high-severity in the browser’s V8 JavaScript and WebAssembly engine. Google paid $100,000 in bug bounty rewards for two of these high-severity V8 defects, tracked as CVE-2025-12428 and CVE-2025-12429; Man Yue Mo of GitHub Security Lab and Aorui Zhang were each rewarded $50,000 for these issues.

The article notes that no technical details are shared publicly, but the rewards suggest potential remote code execution in certain cases. Chrome 142 fixes medium- and low-severity flaws across Storage, Omnibox, Extensions, PageInfo, Ozone, App-Bound Encryption, and V8, and the company says it paid a total of $130,000 for the bugs fixed with the Chrome 142 release. The latest iteration is rolling out as version 142.0.7444.59 for Linux, 142.0.7444.59/60 for Windows, and 142.0.7444.60 for macOS.