GOOGLE has signalled a partial U-turn on its Chrome bug bounty reforms, moving to lift rewards for memory safety vulnerabilities while keeping a tighter overall structure. After cutting base payouts in April to prioritise actionable reports, the company has now quadrupled memory safety base rates to $2,000, with higher totals available for more serious or widespread issues.
In Chrome’s browser, GPU and network process flaws can now earn researchers up to $20,000, while renderer-process issues such as use-after-free and memory write bugs carry a maximum of $8,000.
Other notable changes include a flat $5,000 for V8 sandbox vulnerabilities and $4,000 for V8 logic bugs. A new $2,000 fuzzer bonus has been reintroduced for researchers developing novel fuzzers. The article notes that the updated payouts apply to submissions currently in Google's evaluation queue as of 1 May 2026, and that the new rules do not restore Chrome bug bounties to their pre-April levels.
Google has also paused its Open Source Software Vulnerability Reward Program to product vulnerabilities, amid a surge of AI-generated reports. The package reflects a cautious expansion of incentives for memory safety while acknowledging that broader reward scales remain lower than before the April changes.