Google Reshapes Bug Bounty Payouts: Android Rewards Surge While Chrome Bounties Decline in AI Era

Key Findings

• Google increased Android bug bounty rewards up to $1.5 million for zero-click Pixel exploits, while Chrome payouts dropped significantly across most categories

• The overhaul prioritizes high-impact vulnerabilities and those resistant to AI detection, shifting focus from quantity to quality

• Chrome base rewards for memory safety issues fell to $500 with multipliers, down from previous levels, with some rewards now 10 times smaller

• Google phased out bonuses for arbitrary read/write and remote code execution vulnerabilities due to overwhelming AI-generated submissions

• Despite lower individual payouts, Google expects total 2026 rewards to exceed the record $17.1 million paid in 2025

Background

Google has announced a major restructuring of its Vulnerability Reward Programs for Android and Chrome, driven by the rapid evolution of AI-powered security research tools. Advanced AI systems like Claude Mythos and GPT 5.4 Cyber have transformed bug hunting by automating code analysis and exploit development. Even more widely available AI models have led to a deluge of vulnerability submissions, forcing Google to recalibrate its approach. The company's internal security teams are now processing vulnerabilities at unprecedented rates, making it necessary to evolve bounty programs toward rewarding impact and quality rather than submission volume.

Android Rewards Surge

The Android and Google Devices program saw the most dramatic increases. Google is now heavily incentivizing vulnerabilities that pose high user impact and resist automated AI detection. The top reward for a zero-click exploit targeting the Pixel's Titan M security chip with persistence jumped from $1 million to $1.5 million. Exploits without persistence climbed from $500,000 to $750,000. Secure element data exfiltration rewards increased from $250,000 to $375,000.

The program has also narrowed its scope, focusing on Google-maintained components rather than the entire Linux kernel, unless vulnerabilities can be proven exploitable on actual Android devices. Google is strongly incentivizing reports that include proof-of-concept demonstrations and proposed patches, essentially rewarding researchers who provide complete solutions alongside their findings.

Chrome Strategy Shifts Downward

Chrome is taking the opposite approach. Standard payouts are decreasing across most vulnerability categories. Memory safety issues now start at just $500 with multipliers applied based on exploitability factors. The company eliminated bonuses for arbitrary read/write and remote code execution vulnerabilities that were introduced in 2025, citing the overwhelming flood of AI-generated reports.

The rationale is pragmatic: while AI can effortlessly produce lengthy, detailed technical write-ups, Google's own internal tools now handle explanation and fix suggestions automatically. The company now values concise, verifiable reports with reproducible proof over verbose submissions. Some researchers noted that certain Chrome rewards have dropped to one-tenth their previous value.

One exception remains highly lucrative: full-chain Chrome exploits still command up to $250,000, with an additional $250,000 bonus for bypassing Google's MiraclePtr memory protection system. Google plans to release special Chrome builds to help researchers reproduce complex issues like memory leaks.

Balancing AI and Incentives

Google framed these changes as optimization rather than cost-cutting. The company expects to increase total rewards in 2026 despite lower individual payouts, following a record $17.1 million distributed in 2025. The shift reflects a broader industry challenge: distinguishing meaningful security discoveries from AI-generated noise has become as critical as finding bugs themselves.

Other major programs face similar pressures. The Internet Bug Bounty program recently paused new submissions due to an overwhelming surge in AI-generated reports. Google's balanced approach acknowledges that AI is reshaping cybersecurity without resisting the technology outright, instead channeling it toward more effective vulnerability research by rewarding the work that matters most.

Sources

• https://securityaffairs.com/191600/security/google-revamps-bug-bounty-programs-android-rewards-rise-chrome-payouts-drop-in-the-age-of-ai.html

• https://www.securityweek.com/google-adjusts-bug-bounties-chrome-payouts-drop-as-android-rewards-rise-amid-ai-surge/