Google raises Chrome bug bounty rewards for memory safety issues

Google is updating its security reward program for the Chrome browser. The company said a primary goal is to improve internal testing by finding severe vulnerabilities faster. They are raising payments for memory corruption issues and expanding rewards for other security flaws.

The base reward for memory corruption bugs is increasing four times to $2,000. These errors can cause software to access or modify memory incorrectly, potentially crashing the browser. In severe cases, they allow attackers to run malicious code within the system.

Payments vary based on which part of the browser is affected. Network and GPU processes can earn up to $20,000 for controlled memory writes from web content. The renderer process handles web pages and offers up to $8,000 for similar vulnerabilities there.

Google is also offering rewards for flaws that do not involve memory safety. Medium severity fixes will receive a flat $2,000 if the report leads to an identified fix. High impact sandbox escapes now offer up to $20,000 to researchers who bypass security barriers.

SecurityWeek notes that Google lowered standard payouts in April, where some rewards became ten times smaller. While the new rates are higher than those low points, this report states they remain below amounts offered before the earlier changes. Help Net Security frames the update as an immediate increase to identify severe challenges without mentioning prior cuts.

A $2,000 fuzzer bonus is returning for tools that test software with unusual inputs. New rules apply immediately for reports submitted after April 30, 2026. Researchers should use the Google Bug Hunters portal to submit findings under the updated Chrome VRP terms.