Google Raises Bug‑Bounty Rewards to $1.5M for High‑Impact Android Exploits

Google has revamped its Android and Chrome bug‑bounty programs, offering up to $1.5 million for zero‑click Pixel Titan M2 full‑chain exploits that include persistence, and up to $750 k for the same exploits without persistence.

Chrome rewards now cap at $250 k for full‑chain browser‑process exploits on up‑to‑date OSes and hardware, with an extra $250,128 MiraclePtr bonus for successful exploitation of MiraclePtr‑protected memory. The company is tightening its reporting requirements, demanding concise proofs and essential artifacts while discarding lengthy write‑ups that AI can now generate automatically. Android’s focus shifts to Linux‑kernel vulnerabilities in Google‑maintained components, unless researchers can demonstrate concrete exploitability on Android devices. AI‑generated write‑ups are now considered less valuable, as Google’s internal tooling auto‑explains and suggests fixes. In 2025, Google paid $17.1 million to 747 researchers, a 40 % increase from 2024, bringing total payouts since 2010 to over $81.6 million. Google projects aggregate rewards to rise in 2026 despite reductions in some individual payouts. These changes underscore a strategic shift toward high‑impact, high‑difficulty exploits and streamlined reporting.