Home · Technology · Oct 13 archive
Google Adjusts Chrome VRP, Boosts Rewards for Security Bugs
Confirmed
In Short: Google is making changes to its Chrome Vulnerability Rewards Program (VRP) to encourage more security researchers to find and report bugs.
Google is making further adjustments to its Chrome Vulnerability Rewards Program (VRP) to encourage more security researchers to find and report bugs, according to Android Authority. The company is simplifying reward rates for V8 sandbox issues and V8 logic bugs to a flat rate of $5,000 and $4,000, respectively, and bringing back the $2,000 Chrome Fuzzer Bonus.
Meanwhile, Google is introducing new end-of-year awards to celebrate submissions from the security community, featuring categories such as “Most Findings,” “Best Bug,” and “Best Report,” as reported by Android Authority.
According to Android Authority, Google is also offering a $2,000 reward for all medium-severity, non-memory safety issues, alongside rewards of up to $20,000 for high-impact bugs. Additionally, payouts for writes and use-after-free (UAF) vulnerabilities in the renderer process have been increased to up to $8,000, and reports for controlled reads and crashes in the browser, GPU, and network processes will now earn rewards of $4,000.
Android Authority notes that Google has made several changes to its VRP over the last few months, including reducing Chrome reward payouts in May and using AI to improve Chrome security in July.
The Independent (United Kingdom) reported that researcher Salvatore Gulizia discovered a bug within the hugely popular web browser, which has approximately 3.6 billion users worldwide, and reported it to Google. The criminal threat actor planned to use it in a mass exploitation event, but the proactive counter discovery may have prevented its use.
TechCrunch reported that Google announced on Thursday that it has fixed a whopping 1,072 security bugs in the last two versions of Chrome, both released in June. TechCrunch also noted that Microsoft announced it had patched a record 570 security flaws across its product lines as part of its monthly round of scheduled patches, citing its own use of AI to explain the sudden jump in bug fixes.
Zdnet reported that Google is relying on Gemini to find Chrome security bugs fast and before attackers do. Zdnet also noted that while 40 or 50 vulnerabilities in a month are moderately manageable for a Google-sized team, 1,072 bugs over two releases are overwhelming.
Thenews (Pakistan) reported that Google released a Chrome security update addressing 12 vulnerabilities and issued an emergency update for its Chrome browsers after detecting the most critical bug in the web browser. The Stable channel has been updated to 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, which will roll out over the coming days/weeks.
Both Android Authority and The Independent (United Kingdom) agree that Google is making significant changes to its Chrome VRP to encourage more security researchers to find and report bugs. They also agree that Google is increasing rewards for various types of vulnerabilities and introducing new end-of-year awards.
Android Authority and Thenews (Pakistan) both report that Google is addressing a significant number of security bugs in recent updates, with Android Authority citing 1,072 bugs fixed in the last two versions of Chrome, and Thenews (Pakistan) reporting an emergency update for a critical bug.
The reports from Android Authority and Zdnet highlight the use of AI in improving Chrome security, with Zdnet noting that Google is relying on Gemini to find bugs fast and before attackers do.
In conclusion, both Android Authority and The Independent (United Kingdom) agree that Google is making significant changes to its Chrome VRP to encourage more security researchers to find and report bugs, while also increasing rewards for various types of vulnerabilities and introducing new end-of-year awards.
What this adds
Google's reliance on AI to find Chrome security bugs fast and before attackers do is a new development, as highlighted by Zdnet.
The specific technical blueprints of the bugs are being kept under wraps by Google, as noted by TechRepublic.
The emergency update for a critical bug reported by Thenews (Pakistan) is a significant development, indicating the ongoing threat to Chrome's security.
Background
Google is making changes to its Chrome Vulnerability Rewards Program (VRP) to encourage more security researchers to find and report bugs.
What's confirmed
- Google is making further adjustments to its Chrome Vulnerability Rewards Program (VRP) to encourage more security researchers to find and report bugs, according to Android Authority. The company is simplifying reward rates for V8 sandbox issues and V8 logic bugs to a flat rate of $5,000 and $4,000, respectively, and bringing back the $2,000 Chrome Fuzzer Bonus.
- Meanwhile, Google is introducing new end-of-year awards to celebrate submissions from the security community, featuring categories such as “Most Findings,” “Best Bug,” and “Best Report,” as reported by Android Authority.
- According to Android Authority, Google is also offering a $2,000 reward for all medium-severity, non-memory safety issues, alongside rewards of up to $20,000 for high-impact bugs. Additionally, payouts for writes and use-after-free (UAF) vulnerabilities in the renderer process have been increased to up to $8,000, and reports for controlled reads and crashes in the browser, GPU, and network processes will now earn rewards of $4,000.
- Android Authority notes that Google has made several changes to its VRP over the last few months, including reducing Chrome reward payouts in May and using AI to improve Chrome security in July.
- The Independent (United Kingdom) reported that researcher Salvatore Gulizia discovered a bug within the hugely popular web browser, which has approximately 3.6 billion users worldwide, and reported it to Google. The criminal threat actor planned to use it in a mass exploitation event, but the proactive counter discovery may have prevented its use.
- TechCrunch reported that Google announced on Thursday that it has fixed a whopping 1,072 security bugs in the last two versions of Chrome, both released in June. TechCrunch also noted that Microsoft announced it had patched a record 570 security flaws across its product lines as part of its monthly round of scheduled patches, citing its own use of AI to explain the sudden jump in bug fixes.
- Zdnet reported that Google is relying on Gemini to find Chrome security bugs fast and before attackers do. Zdnet also noted that while 40 or 50 vulnerabilities in a month are moderately manageable for a Google-sized team, 1,072 bugs over two releases are overwhelming.
- Thenews (Pakistan) reported that Google released a Chrome security update addressing 12 vulnerabilities and issued an emergency update for its Chrome browsers after detecting the most critical bug in the web browser. The Stable channel has been updated to 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, which will roll out over the coming days/weeks.
- Both Android Authority and The Independent (United Kingdom) agree that Google is making significant changes to its Chrome VRP to encourage more security researchers to find and report bugs. They also agree that Google is increasing rewards for various types of vulnerabilities and introducing new end-of-year awards.
- Android Authority and Thenews (Pakistan) both report that Google is addressing a significant number of security bugs in recent updates, with Android Authority citing 1,072 bugs fixed in the last two versions of Chrome, and Thenews (Pakistan) reporting an emergency update for a critical bug.
- The reports from Android Authority and Zdnet highlight the use of AI in improving Chrome security, with Zdnet noting that Google is relying on Gemini to find bugs fast and before attackers do.
- In conclusion, both Android Authority and The Independent (United Kingdom) agree that Google is making significant changes to its Chrome VRP to encourage more security researchers to find and report bugs, while also increasing rewards for various types of vulnerabilities and introducing new end-of-year awards.
What's still developing
- Zero-day vulnerabilities have been keeping Chromium developers busy since the new Chrome 128 dropped.
- They’re labeled CVE-2024-8198 and CVE-2024-8193, both classified as high risk.
- According to the official Google Chrome Release blog, the eight patched vulnerabilities include: Google is intentionally keeping the specific technical blueprints of these bugs under wraps for now.
- Trust Wallet is urging users to update its Google Chrome extension to the latest version following what it described as a "security incident" that led to the loss of approximately $7 million.
- "Once decrypted, the mnemonic phrase is sent to the attacker's server api.metrics-trustwallet[.]com." The domain "metrics-trustwallet[.]com" was registered on December 8, 2025, with the first request to "api.metrics-trustwallet[.]com" commencing on December 21, 2025.
- “Given its ease of adoption, it is likely to proliferate further and be adopted by espionage-motivated and financially motivated threat actors as patched versions are fully rolled out across all Chromium-based browsers,” the researchers said.
- At I/O 2025, Google announced that when logging into a website in Chrome with compromised credentials, the browser will display a warning and offer a "Change it for me" button to update your password.
- Currently, Chrome shows a QR code when you try to log into a service and don't have its passkey synced to the device you are using.