Google Boosts Top VRP Bounty to $1.5 Million for Pixel Titan M2 Exploits
Google has increased its top vulnerability bounty to $1.5 million for zero-click Pixel Titan M2 exploits as part of a major overhaul to its Android and Chrome bug reward programs.
Google has significantly overhauled its Android and Chrome Vulnerability Reward Programs (VRPs), introducing a record-breaking $1.5 million bounty for high-impact exploits targeting its hardware. This strategic shift aims to incentivize security researchers to focus on complex, researcher-driven vulnerability classes that remain difficult for automated systems to identify Help Net Security.
The most substantial payout, set at $1.5 million, is reserved for a zero-click, full-chain compromise of Pixel devices that specifically targets the Titan M2 security chip and achieves persistence. If a researcher demonstrates the same full-chain exploit without persistence, the reward is capped at $750,000 Help Net Security.
For the Chrome browser, Google is offering up to $250,000 for full-chain browser process exploits that affect the latest operating systems and hardware. Furthermore, the company is introducing a specific bonus of up to $250,128 for researchers who successfully exploit an allocation protected by MiraclePtr, a technology designed to prevent use-after-free vulnerabilities Help Net Security.
As part of these changes, Google is deprioritizing Linux kernel vulnerabilities within its maintained components unless researchers can provide concrete proof of exploitability on actual Android or Google devices. To encourage higher-quality submissions, the company will now provide additional incentives for reports that include functional patch proposals Help Net Security.
Conversely, Google is discontinuing previous bonus rewards for renderer remote code execution (RCE) and arbitrary read/write vulnerabilities. The company noted that these bonuses were originally intended to confirm exploitability, but as internal tooling has evolved to automatically suggest fixes for such bugs, the program will now focus exclusively on more complex vulnerability classes Help Net Security.
To support this new focus, Google is updating its testing infrastructure by providing researchers with specialized Chrome builds. These builds are designed to facilitate the demonstration of memory access and information leak issues, with detailed guidance to be included in the program's FAQ Help Net Security.
This restructuring reflects a broader industry trend where major technology vendors are moving away from rewarding high-volume, automated bug reporting in favor of deep-dive research into hardware-backed security. By prioritizing the Titan M2 chip and memory-protected browser allocations, Google is signaling that the next frontier of mobile security lies in defending against sophisticated, multi-stage attack chains that bypass traditional software defenses.