GoKawiilGoogle overhauls its Android and Chrome vulnerability rewards programs, offering bounties of up to $1.5 million for the most difficult exploits while scaling back payouts for flaws that artificial intelligence (AI) has made easier to find.
The top reward of $1.5 million is reserved for zero-click Pixel Titan M2 security chip full-chain exploits with persistence, the most technically demanding attack scenario in the program, while the same exploits, but without persistence, are also eligible for up to $750,000.
On the Google Chrome side, full-chain browser process exploits on up-to-date operating systems and hardware now come with rewards of up to $250,000, plus an additional $250,128 bonus for successfully exploiting MiraclePtr-protected memory allocations.
"We know that certain particularly impactful exploits remain incredibly difficult to achieve and we've greatly appreciated collaborating with the researcher community to discover and unearth them," Google said.
"We want to build on this partnership by continuing to emphasize the highest tiers of rewards across both Android and Chrome."
For the Chrome program, Google shifts its focus to concise reports containing only bug proofs and essential artifacts, rather than lengthy written analyses that AI can now generate automatically.
The Android program will also narrow its focus to Linux kernel vulnerabilities in Google-maintained components, unless researchers can demonstrate concrete exploitability on Android devices.
"While AI has made it effortless to produce lengthy, detailed write-ups, our internal tooling has also evolved to help us automatically explain and suggest fixes for bugs," the company added.
This vulnerability rewards program restructuring follows a record year for Google's bug bounty effort, with the company paying $17.1 million to 747 researchers in 2025, a more than 40 percent increase from 2024 and an all-time high.
This has brought the total payouts since the program launched in 2010 to more than $81.6 million, and Google estimates that the total aggregate rewards paid in 2026 will increase despite reductions in some individual reward amounts.