Apple doubles maximum bug bounty to $2M for zero-click RCEs

Apple has doubled its bug bounty rewards, now offering up to $2 million for zero-click remote code execution flaws, according to Apple. Since 2020, it has paid $35 million to 800 researchers. The company says bonuses for Lockdown Mode bypasses and beta bugs can push payouts above $5 million. The expanded programme covers more attack surfaces, with up to $300,000 for one-click WebKit sandbox escapes and $1 million for wireless proximity exploits.

It also introduced Target Flags, enabling researchers to prove exploitability for top categories like RCE and TCC bypasses and receive faster payouts once verified, with higher rewards for five key attack vectors to drive deeper, offensive-style research. Apple’s Security Engineering and Architecture (SEAR) team studies mercenary-spyware-style exploit chains to harden defenses, and the new framework prioritises complex exploit chains that mirror sophisticated real-world attacks.

The updated awards and Target Flags are designed to help verify findings automatically and speed reward decisions, even before patches are released, per the accompanying announcement.