Changes to the Chrome VRP
Summary
- Published
- Collected
📦 Full-Text Content Snapshot
R2 Archive · Full Article PreservedAuthors: Alex Gough, Jon Serpas (Chrome VRP) · Published: Oct 13, 2026 · Source: bughunters.google.com
Today we are announcing changes to the Chrome Vulnerability Rewards Program which take effect immediately.
A primary goal of the Chrome VRP has always been to identify ways to improve our internal testing by understanding which vulnerabilities are the most severe and challenging to uncover. Earlier this year, we adjusted our rewards framework to focus on reproducible, high-impact issues. This helped to streamline reporting expectations amidst rapid shifts in security research and the success of our own AI-powered vulnerability detection efforts. We’re now looking to learn where these efforts can be further strengthened.
Today we are adjusting our reward amounts and program categories to reward more types of deep security research, recognize high-value fixes across more severity tiers, and provide new opportunities for researcher recognition.
Key Changes to the Program
Quadrupling Base Rates for Memory Safety
To ensure that complex memory safety research is appropriately rewarded, we are increasing the base reward amount for memory corruption vulnerabilities to $2,000 (a 4x increase).
- Browser, Network, and GPU processes: Payouts now range from $4,000 for reads and crashes up to $20,000 for controlled writes demonstrated from web contents.
- Renderer process: Payouts for writes and UAFs increase up to $8,000, with V8 sandbox issues moving to a simplified flat rate of $5,000 and V8 logic bugs rewarded at $4,000.
Rewarding Medium-Severity Fixes and Non-Memory Safety Escapes
We’re also broadening our scope to ensure impactful contributions beyond critical memory corruption are recognized:
- Medium Severity (S2): All non-memory safety issues assessed at Medium severity will receive a flat rate of $2,000, provided the report includes or directly leads to an identified fix.
- Sandbox Escapes (Non-Memory Safety): We are introducing rewards of up to $20,000 for high-impact, non-memory safety sandbox escapes.
Chrome Fuzzer Bonus
Fuzzing remains one of the most effective ways to discover new classes of vulnerabilities. We are reviving a $2,000 Chrome Fuzzer Bonus for researchers who develop and contribute novel fuzzers. Details on fuzzer submission guidelines and intake procedures are available on our VRP FAQ in collaboration with the Chrome Fuzzing team.
Community Recognition
To celebrate and encourage continued contributions in our community, we are also implementing new discretionary end-of-year rewards (e.g. “Most Findings, Best Report, Best Bug,” etc.).
Looking Ahead
| Category | Reads & Crashes | Writes & UAF | Controlled Read (--vrp-flags) | Controlled Write (--vrp-flags) |
|---|---|---|---|---|
| Browser / Network / GPU | Up to $4,000 | Up to $10,000 | Up to $10,000 | Up to $20,000 |
| Renderer Process | $3,000 | $8,000 | V8 Logic: $4,000 | V8 Sandbox: $5,000 |
| Other Sandboxed Processes | $2,000 | $3,000 | N/A | N/A |
| Moderately Mitigated (S2) | $2,000 | $2,000 | N/A | N/A |
As always, please ensure all submissions are submitted directly through Google Bug Hunters (select ‘Chrome VRP’).
The new categories and rule changes will be updated on our VRP Rules page.
[!IMPORTANT] Any submissions that are currently in our evaluation queue submitted after April 30th, 2026 will be evaluated and rewarded under the new payout rules!
We want to thank our global researcher community for your continued collaboration and dedication to making Chrome and the wider web more secure.
📦 Full-Text Markdown Snapshot archived by Phying News · Original source: bughunters.google.com
--- id: 9101 canonical_url: "https://phying.com/item/9101" title: "Changes to the Chrome VRP" type: "research" cve: null cvss: null severity: "unknown" vendor: "Google" product: "Chrome" affected_versions: null source_domain: "bughunters.google.com" source_url: "https://bughunters.google.com/blog/changes-to-the-chrome-vrp-restructuring-rewards" published_at: "2026-10-13T00:00:00Z" snapshot_at: "2026-10-26T05:50:00Z" archived_by: "Phying News (https://phying.com/item/9101)" lang: "en" --- # Changes to the Chrome VRP *Authors: Alex Gough, Jon Serpas (Chrome VRP) · Published: Oct 13, 2026 · Source: [bughunters.google.com](https://bughunters.google.com/blog/changes-to-the-chrome-vrp-restructuring-rewards)* Today we are announcing changes to the [Chrome Vulnerability Rewards Program](https://bughunters.google.com/about/rules/chrome-friends/chrome-vulnerability-reward-program-rules) which take effect immediately. A primary goal of the Chrome VRP has always been to identify ways to improve our internal testing by understanding which vulnerabilities are the most severe and challenging to uncover. Earlier this year, we adjusted our rewards framework to focus on reproducible, high-impact issues. This helped to streamline reporting expectations amidst rapid shifts in security research and the success of our own [AI-powered vulnerability detection](https://blog.google/security/chrome-stronger-with-every-update/) efforts. We’re now looking to learn where these efforts can be further strengthened. Today we are adjusting our reward amounts and program categories to reward more types of deep security research, recognize high-value fixes across more severity tiers, and provide new opportunities for researcher recognition. --- ## Key Changes to the Program ### Quadrupling Base Rates for Memory Safety To ensure that complex memory safety research is appropriately rewarded, we are increasing the base reward amount for memory corruption vulnerabilities to **$2,000** (a 4x increase). - **Browser, Network, and GPU processes:** Payouts now range from **$4,000** for reads and crashes up to **$20,000** for [controlled writes](https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/vrp-faq.md#demonstrating-controlled-read-or-write) demonstrated from web contents. - **Renderer process:** Payouts for writes and UAFs increase up to **$8,000**, with V8 sandbox issues moving to a simplified flat rate of **$5,000** and V8 logic bugs rewarded at **$4,000**. ### Rewarding Medium-Severity Fixes and Non-Memory Safety Escapes We’re also broadening our scope to ensure impactful contributions beyond critical memory corruption are recognized: - **Medium Severity (S2):** All non-memory safety issues assessed at Medium severity will receive a flat rate of **$2,000**, provided the report includes or directly leads to an identified fix. - **Sandbox Escapes (Non-Memory Safety):** We are introducing rewards of up to **$20,000** for high-impact, non-memory safety sandbox escapes. ### Chrome Fuzzer Bonus Fuzzing remains one of the most effective ways to discover new classes of vulnerabilities. We are reviving a **$2,000 Chrome Fuzzer Bonus** for researchers who develop and contribute novel fuzzers. Details on fuzzer submission guidelines and intake procedures are available on our [VRP FAQ](https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/vrp-faq.md#Contributing-Fuzzers) in collaboration with the Chrome Fuzzing team. ### Community Recognition To celebrate and encourage continued contributions in our community, we are also implementing new discretionary end-of-year rewards (e.g. “Most Findings, Best Report, Best Bug,” etc.). --- ## Looking Ahead | Category | Reads & Crashes | Writes & UAF | Controlled Read (`--vrp-flags`) | Controlled Write (`--vrp-flags`) | | :--- | :--- | :--- | :--- | :--- | | **Browser / Network / GPU** | Up to $4,000 | Up to $10,000 | Up to $10,000 | Up to $20,000 | | **Renderer Process** | $3,000 | $8,000 | V8 Logic: $4,000 | V8 Sandbox: $5,000 | | **Other Sandboxed Processes** | $2,000 | $3,000 | N/A | N/A | | **Moderately Mitigated (S2)** | $2,000 | $2,000 | N/A | N/A | As always, please ensure all submissions are submitted directly through [Google Bug Hunters](https://bughunters.google.com/report/vrp) (select ‘Chrome VRP’). The new categories and rule changes will be updated on our [VRP Rules page](https://bughunters.google.com/about/rules/chrome-friends/chrome-vulnerability-reward-program-rules). > [!IMPORTANT] > **Any submissions that are currently in our evaluation queue submitted after April 30th, 2026 will be evaluated and rewarded under the new payout rules!** We want to thank our global researcher community for your continued collaboration and dedication to making Chrome and the wider web more secure. --- > 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/9101) · Original source: [bughunters.google.com](https://bughunters.google.com/blog/changes-to-the-chrome-vrp-restructuring-rewards)