Google Partially Reverses Chrome Bug Bounty Cuts
Google increases Chrome bug bounty rewards for memory safety vulnerabilities.
Run Google?
Get an email when a reviewed story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Google is raising bug bounty rewards for certain Chrome vulnerabilities, specifically memory safety issues, in response to evolving threat landscapes influenced by AI. While base rates for memory safety flaws are quadrupled to $2,000, they remain lower than pre-April levels. The company is also reintroducing a $2,000 fuzzer bonus and will apply new payout rules to pending submissions.
The lesson from this incident
Full lessonGoogle's partial reversal of Chrome bug bounty cuts highlights the critical role that vulnerability reward programs play in incentivizing security researchers to responsibly disclose flaws — particularly memory safety issues, which remain among the most exploited vulnerability classes. When bounty rewards are reduced, researcher motivation diminishes, potentially leaving critical vulnerabilities undiscovered and unpatched. The influence of AI on the threat landscape signals that attackers are becoming more capable of finding and exploiting flaws faster, making external research programs more vital than ever. Organizations that undervalue bug bounty and responsible disclosure programs risk losing a key layer of proactive defense. Aligning reward structures to the severity and exploitability of vulnerability classes ensures the most dangerous bugs receive the attention they deserve.
