Google Increases Top Android Bug Bounty to $1.5 Million Amid Program Overhaul
Google has overhauled its Android and Chrome bug bounty programs, offering up to $1.5 million for high-end exploits while scaling back rewards for vulnerabilities easily identified by AI.
Google has significantly restructured its vulnerability rewards programs for Android and Chrome, introducing a record-breaking $1.5 million bounty for the most sophisticated exploit chains. This shift in strategy prioritizes high-impact, technically demanding research while simultaneously reducing payouts for lower-tier vulnerabilities that have become easier to identify through the use of artificial intelligence BleepingComputer.
The new top-tier reward of $1.5 million is specifically reserved for zero-click, full-chain exploits targeting the Pixel Titan M2 security chip that maintain persistence on the device. For similar exploits that do not achieve persistence, researchers can still earn up to $750,000. These changes reflect Google’s focus on the most difficult-to-execute attack scenarios that pose the greatest risk to user security BleepingComputer.
In the Chrome ecosystem, Google is offering up to $250,000 for full-chain browser process exploits on current operating systems and hardware. Furthermore, the company has introduced a substantial bonus of $250,128 for researchers who successfully bypass MiraclePtr-protected memory allocations, a key defense mechanism in the browser BleepingComputer.
The program restructuring also changes how researchers submit their findings. For Chrome, Google is moving away from requiring lengthy written analyses, which the company notes can now be generated automatically by AI. Instead, the program will prioritize concise reports that focus on bug proofs and essential artifacts. Similarly, the Android program is narrowing its scope to focus primarily on Linux kernel vulnerabilities within Google-maintained components, unless researchers can provide clear evidence of exploitability on actual Android devices BleepingComputer.
These updates follow a record-breaking year for Google’s bug bounty efforts. In 2025, the company paid out $17.1 million to 747 researchers, marking a 40 percent increase over 2024. Since the inception of the program in 2010, Google has paid out more than $81.6 million in total rewards. Despite the reduction in payouts for vulnerabilities that are now easily discovered by AI, Google anticipates that the total aggregate rewards paid out in 2026 will continue to rise BleepingComputer.
This strategic pivot highlights the evolving landscape of cybersecurity research, where the automation of routine bug discovery is forcing vendors to incentivize deeper, more complex research. By shifting resources toward the most difficult exploit chains, Google aims to maintain a competitive edge in securing its platforms against advanced persistent threats that remain beyond the reach of automated tooling BleepingComputer.