Google Revamps Bug Bounty Program: Now Pays Up to $1.5 Million for Top Android Exploits

Google’s Vulnerability Rewards Program Gets a Major Update

Google has announced a significant overhaul of its Vulnerability Rewards Program (VRP) for Android and Chrome, introducing a top payout of $1.5 million for the most advanced exploits while simultaneously reducing rewards for lower-severity bugs—especially those that artificial intelligence (AI) can now find with relative ease. The move reflects the evolving landscape of cybersecurity, where both attackers and defenders leverage cutting-edge technology.

Android VRP: Boosted Bounties for Critical Chains

The Android VRP now offers up to $1.5 million for a complete, high-impact exploit chain that compromises the Android kernel or TrustZone. This represents a substantial increase from the previous maximum of $1 million. The updated program also introduces a new category for partial chains—for example, a kernel exploit paired with a browser vulnerability—with bounties ranging from $500,000 to $1 million. Individual critical vulnerabilities still pay well, but the emphasis is clearly on incentivizing researchers to demonstrate full end-to-end attacks.

Chrome VRP Adjustments

Similarly, Google’s Chrome VRP has been restructured. The top reward for a “magic” exploit—one that bypasses all security layers in the browser—remains at $150,000, but Google has added new categories for lower-severity issues. Researchers can now earn up to $30,000 for high-severity bugs that affect multiple Chrome components. However, the company has reduced payouts for simpler flaws, such as memory corruption in less-critical areas, by roughly 20–30%.

AI-Driven Bug Discovery: Why Rewards Are Dropping

A key driver of the change is the increasing role of AI in vulnerability research. Google notes that tools like large language models (LLMs) and automated fuzzers have made it easier to find common software bugs. As a result, the company is lowering bounties for vulnerability types that AI can now detect reliably—for instance, certain cross-site scripting (XSS) or integer overflow issues. The new guidelines explicitly state that rewards for AI-identifiable flaws will be reduced, sometimes by half. Google argues this encourages researchers to focus on more complex, novel exploits that require human creativity.

“We believe that by adjusting our rewards, we can steer the research community toward the hardest problems—the ones that truly protect users,” said a Google security spokesperson in a statement. The move echoes similar adjustments at other tech firms, such as Microsoft and Apple, which have also updated bug bounty programs in response to AI capabilities.

How Researchers Can Participate

The updated VRP applies to all submissions made after the announcement. Researchers are encouraged to submit their findings via Google’s Bug Hunter portal. Google has also simplified its reward tiers:

• Critical Android chain: $1.5 million
• Partial Android chain: $500k–$1 million
• Critical Android individual bug: Up to $200,000
• High-severity Chrome exploit: Up to $150,000
• Medium-severity Chrome bug: Up to $30,000

In addition to monetary rewards, top researchers may receive Google Hall of Fame recognition and invitations to exclusive security events.

Industry Response and Implications

Security researchers have reacted with a mix of excitement and caution. Some applaud the increased top bounty, calling it a “game-changer” for full-chain research. Others worry that the reduced payouts for AI-detectable bugs could discourage legitimate researchers while failing to deter malicious actors who do not rely on bug bounty rewards. Google, however, maintains that the updated program will ultimately lead to stronger defenses by incentivizing in-depth analysis.

“This isn’t about paying less overall—it’s about paying for the right things,” explained Sarah Li, a cybersecurity analyst at CyberScoop. “If you want to find the next Spectre-like vulnerability, Google is willing to invest millions. But if you’re just running an automated tool to find buffer overflows, you’re not getting the same reward anymore.”

Looking Ahead: The Future of Bug Bounties

The changes signal a broader trend in the cybersecurity industry: AI is reshaping the economics of vulnerability discovery. As machine learning models become more adept at spotting common bugs, programs like Google’s VRP will likely continue to evolve. Researchers who want to maximize their earnings will need to specialize in more sophisticated attack vectors, such as side-channel attacks, speculative execution exploits, or hardware-level vulnerabilities. For now, Google’s $1.5 million bounty stands as a clear message: the company is willing to pay top dollar for the toughest problems, but expects researchers to stay ahead of the AI curve.

For more details, visit the official Google Bug Hunter site.