PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Google VRPs in Review – 2024

bughunters.google.com | blog | #bug-bounty | #rewards | #google | #vrp | #annual-review
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

This blog post takes you through the 2024 highlights across the assorted VRPs at Google, recapping a year of reports, rewards, and program milestones.
Published
Collected

Related coverage

blog · bughunters.google.com
Evolving the Android & Chrome VRPs for the AI Era
Google announces immediate changes to the Android and Chrome VRPs, adjusting reward amounts and bonuses to prioritize the report types and bug categories that provide the most security value.
blog · bughunters.google.com
Android VRP Announces AutoRepro – $1,000 bonus for eligible submissions!
The Android & Google Devices VRP now pays a $1,000 bonus for reports with an AutoRepro automated test. Eligible tests must accompany High or Critical severity submissions and run on a Linux host.
blog · bughunters.google.com
Increasing Google & Alphabet VRP rewards up to $151,515
The reward amounts on offer by the Google VRP have undergone a major overhaul: We're increasing reward amounts by up to 5x (with maximum rewards of up to $151,515)!
blog · bughunters.google.com
Announcing Bugcrowd as a new bughunters.google.com payment option
Google added Bugcrowd as a new payment option on bughunters.google.com, letting researchers receive VRP rewards through the platform alongside existing methods.
research · bughunters.google.com
Changes to the Chrome VRP
Today we are announcing changes to the [Chrome Vulnerability Rewards Program](about/rules/chrome-friends/chrome-vulnerability-reward-program-rules), adjusting our reward amounts and program categories to reward deeper security research, recognize high-value fixes across more severity tiers, and provide new opportunities for researcher recognition.
vulnerability · bugcrowd.com
Evaluating the Business Impact of Software Vulnerabilities
After Google raised top payouts for RCE bugs by 50%, Bugcrowd discusses when to adjust bounty ranges, noting most self-run programs stall without managed support.
Back