Google Raises Rewards for Chrome Memory-Safety Bugs
Google has revised the Chrome VRP rewards program. The base reward for memory corruption bugs has increased from $500 to $2,000, with higher rates also applying to other types of findings.
Chrome VRP rewards are changing as of October 13, 2026. Google has immediately increased the base reward for bugs that compromise memory safety, also known as memory corruption, from $500 to $2,000. The change applies to the Chrome Vulnerability Reward Program (VRP), through which the company rewards security researchers for reported vulnerabilities.
This is not an announcement of a fix for a specific browser bug or information about an actively exploited vulnerability. Google is adjusting the program’s financial terms.
Chrome VRP rewards increase for more serious findings
The base rate for memory corruption bugs has quadrupled to $2,000. For vulnerabilities in browser, network, and GPU processes, the reward can reach $20,000 under the new rules.
For memory-write bugs and use-after-free issues in the renderer process, the program sets a maximum reward of $8,000.
Google has also introduced a flat $2,000 reward for medium-severity bugs that do not compromise memory safety. The condition is that the report must include a fix or directly lead to an identified fix.
Sandbox escape rewards and new fuzzers
The new terms also provide for a reward of up to $20,000 for a sandbox escape if it does not involve a memory-safety bug.
The company has also restored a $2,000 bonus for new fuzzers. A fuzzer is a tool that automatically tests software with a large number of inputs to trigger bugs or unexpected behavior. The practical conditions will be important to monitor in the updated program rules and FAQ.
New rules will also affect some pending reports
Google said that reports in the queue submitted after April 30, 2026, will be evaluated under the new rules.
The April program update shifted the focus toward demonstrable findings that are harder to automate and set a base reward of $500 for memory-safety bugs. The October rules raise this base rate to $2,000 and add or restore selected incentive mechanisms.
Google did not describe the change as a direct reversal of the April cuts. It also did not say that the Chrome VRP adjustment was related to the October restriction on accepting product reports in the separate OSS VRP program.
What to watch next
For researchers, the new rates increase rewards for challenging memory-safety research, sandbox escapes, and some medium-severity reports that provide a usable fix. Further details may appear in the updated Chrome VRP rules and FAQ, particularly regarding the criteria for the fuzzer bonus. It also remains an open question whether Google will later provide a broader explanation of the program’s long-term strategy.
Sources
- Google Bug Hunters — Changes to the Chrome VRP – Primarily confirms the date, immediate effectiveness, new rates, fuzzer bonus, and retrospective evaluation of queued reports under the new rules.
- Google Bug Hunters — Evolving the Android & Chrome VRPs for the AI Era – Documents the April change, in which Google reduced some rewards and set a base reward of $500 for memory-safety bugs.
- SecurityWeek — Google Partially Reverses Chrome Bug Bounty Cuts – Independently summarizes the new rates and compares them with the April reward adjustment.
Verified and updated: October 14, 2026 06:26
