Google bug bounty programs
google.com Updated
Google runs 16 public programs on its own site and Sorona; 16 pay cash, the most up to $1,500,000 (Android and Google Devices Security Rewards). 14 companies it owns, including google.github.io and Chromium, run 18 more programs.
- Top reward
- $1,500,000
- Self-hosted
- Programs
- 34
- 33 pay cash
- Targets in scope
- 277
- 8 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
16 programs Google runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Google and Alphabet VRP
Self-hosted · The company-wide program. Pays up to $101,010.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Android and Google Devices Security Rewards
Self-hosted · Bug bounty |
– | – | – | – | $1,500,000 | Partial | – | – | Open |
|
ChromeOS VRP
Self-hosted · Bug bounty |
$30k (highest) | $15k | $1,000 | – | $500,000 | – | Required | – | Open |
|
Google Mobile VRP
Self-hosted · Bug bounty |
– | – | – | – | $300,000 | – | – | – | Open |
|
Chrome Vulnerability Rewards
Self-hosted · Bug bounty |
– | – | – | – | $250,128 | Partial | – | – | Open |
|
Google Cloud VRP
Self-hosted · Bug bounty |
– | – | – | – | $250,000 | Partial | – | – | Open |
|
Google and Alphabet VRP
Self-hosted · Bug bounty |
– | – | – | – | $101,010 | Partial | – | – | Open |
|
Google Open Source Software VRP
Self-hosted · Bug bounty |
– | – | – | – | $31,337 | – | – | – | Open |
|
Google AI VRP
Self-hosted · Bug bounty |
– | – | – | – | $20,000 | Partial | Required | – | Open |
|
minijail
Sorona · Bug bounty |
– | $16k (highest) | $1,250 | – | $16,000 | Partial | – | – | Open |
|
Google Patch Rewards
Self-hosted · Bug bounty |
– | – | – | – | $15,000 | – | – | – | Open |
|
Google Abuse VRP
Self-hosted · Bug bounty |
– | $13.3k | $5,000 (highest) | $1,337 (highest) | $13,337 | – | – | – | Open |
|
Chrome Extensions VRP
Self-hosted · Bug bounty |
– | $5,000 | – | – | $10,000 | Partial | – | – | Open |
|
Tink
Sorona · Bug bounty |
– | – | – | – | $7,500 | Partial | – | – | Open |
|
libwebp
Sorona · Bug bounty |
– | – | – | – | $5,000 | Partial | – | – | Open |
|
Agent Development Kit
Sorona · Bug bounty |
– | – | – | – | $3,100 | Partial | – | – | Open |
|
Site Kit by Google
Sorona · Bug bounty |
– | – | – | – | $3,100 | Partial | – | – | Open |
-
- Safe harbor
- Partial
-
- Critical
- $30k (highest)
- High
- $15k
- Medium
- $1,000
- Low
- –
- KYC
- Required
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
- KYC
- Required
-
- Critical
- –
- High
- $16k (highest)
- Medium
- $1,250
- Low
- –
- Safe harbor
- Partial
-
- Critical
- –
- High
- $13.3k
- Medium
- $5,000 (highest)
- Low
- $1,337 (highest)
-
- Critical
- –
- High
- $5,000
- Medium
- –
- Low
- –
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Google owns
14 companies with 18 programs of their own. Each has its own scope and rules: report to the one that owns the asset.
-
$250k
google.github.io
2 programs, best: kvmCTF (Linux KVM hypervisor)
Sorona · Bug bounty
-
$250k
Chromium
Sorona · Bug bounty
-
$25k
Android
2 programs, best: Android Virtualization Framework and pKVM
Sorona · Bug bounty
-
$10k
Verily
Verily Life Sciences
HackerOne · Bug bounty
-
$7,500
Go
Sorona · Bug bounty
-
$7,500
Flutter
Sorona · Bug bounty
-
$7,500
Angular
Sorona · Bug bounty
-
$7,500
Bazel
Sorona · Bug bounty
-
$7,500
gVisor
Sorona · Bug bounty
-
$7,500
protobuf.dev
Protocol Buffers
Sorona · Bug bounty
-
$3,100
TensorFlow
3 programs, best: TensorFlow.js
Sorona · Bug bounty
-
$3,100
Dart
Dart SDK
Sorona · Bug bounty
-
$3,100
jax.dev
JAX and OpenXLA
Sorona · Bug bounty
-
No cash
pub.dev
Google
security.txt · Disclosure only
What is in scope
277 targets across all 34 programs, each listed once with the programs that cover it. 166 excluded.
-
google.com
Domains
Covered by Google Cloud VRP, Google AI VRP, Google Patch Rewards, Google and Alphabet VRP
-
www.google.com/url?q=http%3a%2f%2fgousto.co.uk&sa=d&usg=aovvaw2g-isg54f9h1jqrehhv16e&ust=1794058337912978
Domains No bounty
Covered by Google and Alphabet VRP
-
www.google.com/url?q=http%3a%2f%2fgousto.co.uk&sa=d&usg=aovvaw3lv2wa7q31fhxvvnwyo7tf&ust=1789202613399893
Domains No bounty
Covered by Google and Alphabet VRP
-
www.google.com/url?q=http%3a%2f%2fgousto.co.uk&sa=d&usg=aovvaw3y1q9dyeuhng2fqi89iynx&ust=1789081697025457
Domains No bounty
Covered by Google and Alphabet VRP
-
www.google.com/url?q=http%3a%2f%2fgousto.ie&sa=d&usg=aovvaw2mjnwl1yakdvczxafuqdsn&ust=1789081697025605
Domains No bounty
Covered by Google and Alphabet VRP
-
www.google.com/url?q=http%3a%2f%2fgousto.ie&sa=d&usg=aovvaw3f2ackw7ozir2o8tf3tg8j&ust=1794058337913102
Domains No bounty
Covered by Google and Alphabet VRP
-
www.google.com/url?q=http%3a%2f%2fgousto.ie&sa=d&usg=aovvaw3fq33v1jlodlo4fp8yaddr&ust=1789202613400034
Domains No bounty
Covered by Google and Alphabet VRP
-
https://google.github.io/security-research/kernelctf/rules.html
Web
Covered by kernelCTF (Linux kernel LTS)
-
https://google.github.io/security-research/kvmctf/rules.html
Web
Covered by kvmCTF (Linux KVM hypervisor)
-
https://source.android.com/docs/core/virtualization
Web
Covered by Android Virtualization Framework and pKVM
-
Bugs in Google- and Waymo-developed apps published in the Apple App Store
iOS
Covered by Google and Alphabet VRP
-
Android Open Source Project (AOSP) code
Source code
Covered by Android and Google Devices Security Rewards
-
public repositories of Google-owned GitHub organizations
Source code
Covered by Google Open Source Software VRP
-
selected repositories hosted on other platforms
Source code
Covered by Google Open Source Software VRP
-
Tier 1 : Please see the full list on https://github.com/google/bughunters/blob/main/patch-rewards-program/scope.md
Source code
Covered by Google Patch Rewards
-
Chromebooks or ChromeOS Flex devices on supported hardware running the latest available version of ChromeOS in our Stable, Beta, or Developer channels in verified mode
Hardware and IoT
Covered by ChromeOS VRP
-
Fitbit Trackers and Smartwatches
Hardware and IoT
Covered by Android and Google Devices Security Rewards
-
Nest Cameras, Speakers, Displays, Thermostats, and Routers
Hardware and IoT
Covered by Android and Google Devices Security Rewards
-
Pixel phones, Pixel Tablets, and Pixel Watches
Hardware and IoT
Covered by Android and Google Devices Security Rewards
-
@angular/common/http: interceptors, JSONP, and the XSRF token handling that guards outbound authenticated requests
Products and areas
Covered by Angular
-
@angular/router: route matching, guards, resolvers, parameter and fragment handling, and lazy-loaded route boundaries
Products and areas
Covered by Angular
-
All of the execution backends the repository ships: WebGL, WebGPU, the CPU backend, and tfjs-backend-wasm with its SIMD kernels, each running in the page's own origin
Products and areas
Covered by TensorFlow.js
-
Alpha-channel decoding and the filtering applied to the alpha plane
Products and areas
Covered by libwebp
-
Android TV, WearOS, Android Automotive OS (AAOS), and GooglebookOS
Products and areas
Covered by Android and Google Devices Security Rewards
-
Angular is a Google-owned GitHub organisation, which the program's own scope sentence covers, and the tier file names four of its repositories at OT0: angular/angular, angular/angular-cli, angular/components and angular/dev-infra. A product vulnerability anywhere in those four is priced at $500 to $7,500
Products and areas
Covered by Angular
-
Angular Material and the CDK in angular/components: overlays, dialogs, menus, tables and every component that renders content the application did not author
Products and areas
Covered by Angular
-
angular/dev-infra, the shared build, release and CI tooling the other three repositories run through, along with npm publishing and release signing in the supply-chain category
Products and areas
Covered by Angular
-
Any abuse risk in services under the Google VRP scope
Products and areas
Covered by Google Abuse VRP
-
any Google Cloud product or web service that handles reasonably sensitive user data
Products and areas
Covered by Google Cloud VRP
-
Any subsystem the Container-Optimized OS config compiles in and an unprivileged local user can reach: the syscall entry paths, the VFS and the filesystems built into that config, memory management, the scheduler, futexes and System V IPC, cgroups, eBPF, perf and tracing, the /proc and /sys interfaces, and the character and block devices exposed under /dev
Products and areas
Covered by kernelCTF (Linux kernel LTS)
-
AOSP code as it ships across Android TV, WearOS and Android Automotive OS, which the same platform-and-software scope covers
Products and areas
Covered by Android Virtualization Framework and pKVM
-
arch/x86/kvm in full: the VMX and SVM entry paths, VM-exit handling, and the vCPU state machine behind them
Products and areas
Covered by kvmCTF (Linux KVM hypervisor)
-
ART in full: the interpreter, the optimizing compiler, dex2oat ahead-of-time compilation, the JIT and the garbage collector
Products and areas
Covered by Android Runtime (ART) and libcore
-
Authentication and credentials: the OAuth flow that connects a site to those services, the client half of the proxy sign-in handshake with sitekit.withgoogle.com, and the storage, refresh, scoping and revocation of the tokens it receives
Products and areas
Covered by Site Kit by Google
-
bazelbuild/continuous-integration, the CI infrastructure configuration that Bazel's own releases are built on
Products and areas
Covered by Bazel
-
Both 0-day and 1-day vulnerabilities: a bug already patched upstream still earns the base reward, it just does not carry the $20,000 0-day bonus
Products and areas
Covered by kernelCTF (Linux kernel LTS)
-
bzlmod module resolution, registry fetching, lockfile generation and lockfile verification, where a gap substitutes one dependency for another
Products and areas
Covered by Bazel
-
Callbacks and plugins, the framework's own interception points and the place a developer's guardrails are implemented
Products and areas
Covered by Agent Development Kit
-
Chrome's built-in AI features, which the reward table carries on separate rows for rogue actions and for sensitive data exfiltration
Products and areas
Covered by Chromium
-
Code execution in hypervisors generally, which the program's arbitrary-code-execution category lists beside the TEE and Secure Elements
Products and areas
Covered by Android Virtualization Framework and pKVM
-
Cross-language behaviour, where two bindings read the same keyset or the same ciphertext and disagree about it
Products and areas
Covered by Tink
-
Cryptographic weaknesses such as practical key recovery, constant-time failures, or signature and certificate-validation bypass in crypto/tls and crypto/x509
Products and areas
Covered by Go
-
dart:ffi and the native interop layer, the boundary at which Dart hands pointers and struct layouts to code the VM does not control
Products and areas
Covered by Dart SDK
-
Defects in the Go toolchain itself: the gc compiler, the linker and assembler, the go command, and go vet
Products and areas
Covered by Go
-
descriptor.proto, the reflection API, dynamic message construction, and the well-known types including Any, Struct, Timestamp and Duration
Products and areas
Covered by Protocol Buffers
-
Deserialisation in tfjs-layers and tfjs-core: model topology, layer classes, custom-object resolution and the config a saved model carries
Products and areas
Covered by TensorFlow.js
-
DevTools: the debug service connection, VM Service protocol exposure and the DevTools web application itself
Products and areas
Covered by Flutter
-
DEX and CompactDex file parsing and verification, including the bytecode verifier that decides whether attacker-supplied code is allowed to run at all
Products and areas
Covered by Android Runtime (ART) and libcore
-
DomSanitizer, the bypassSecurityTrust* family, and the HTML, URL, style and resource-URL sanitisers, which the program names as a reward category of its own: "Failures in the sanitizer functions (e.g. HTML sanitizers)"
Products and areas
Covered by Angular
-
Every primitive the library exposes: AEAD, deterministic AEAD, streaming AEAD, MAC, PRF, digital signatures, hybrid encryption and JWT, together with the subtle layer each of them is built on
Products and areas
Covered by Tink
-
Every REST route the plugin registers, the permission_callback on each one, and the data those routes return
Products and areas
Covered by Site Kit by Google
-
Every runtime the monorepo ships: C++, Java, Kotlin, Python, Go, C#, Ruby, PHP and Objective-C, along with the upb core the newer ones are built on
Products and areas
Covered by Protocol Buffers
-
Extensions in the default-installed extension list
Products and areas
Covered by Chrome Extensions VRP
-
Filesystem confinement: chroot and pivot_root, the mount table minijail builds, bind mounts and their flags, and the /proc and /dev views a jail is left holding
Products and areas
Covered by minijail
-
flutter_tools: the build pipeline, pub dependency resolution, artifact download and verification, and the code-signing steps that produce a shippable binary
Products and areas
Covered by Flutter
-
Forms in both the reactive and template-driven flavours, and the validators applications rely on to constrain user input
Products and areas
Covered by Angular
-
Google takes any High or Critical severity bug in Chrome Browser and extends that to the third-party components it ships or uses, which covers libwebp
Products and areas
Covered by libwebp
-
Google Workspace core applications (i.e., Gmail, Drive, Meet, Calendar, Docs, Sheets, Slides, and Forms)
Products and areas
Covered by Google AI VRP
-
Google Workspace non-core applications (i.e., NotebookLM, Appsheet, etc)
Products and areas
Covered by Google AI VRP
-
Google's declaration is one sentence: any High or Critical severity bug in Chrome Browser may be considered, qualified only by the requirement that it reach the Stable, Beta or Dev channel
Products and areas
Covered by Chromium
-
Google's open-source VRP takes security bugs in the latest versions of code held in Google-owned GitHub organisations, and its tier file names all four ADK bindings at OT1: google/adk-python, google/adk-go, google/adk-java and google/adk-js. A product vulnerability anywhere in those four repositories is priced at $101 to $3,133.70, with no component carved out
Products and areas
Covered by Agent Development Kit
-
Google's open-source VRP takes security issues in the latest versions of the code held in the public repositories of Google-owned GitHub organisations, and the tier file names tensorflow/serving at TIER_OT1. A product vulnerability anywhere in that repository is accepted, at $101 to $3,133.70
Products and areas
Covered by TensorFlow Serving
-
Google's open-source VRP takes security issues in the latest versions of the code held in the public repositories of Google-owned GitHub organisations, and the tier file names tensorflow/tfjs at TIER_OT1. A product vulnerability anywhere in that repository is accepted, at $101 to $3,133.70
Products and areas
Covered by TensorFlow.js
-
Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and google/gvisor is named in the published tier file at TIER_OT0: a product vulnerability anywhere in the project's own code is accepted, at $500 to $7,500
Products and areas
Covered by gVisor
-
Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and google/site-kit-wp is named in the published tier file at TIER_OT1: a product vulnerability anywhere in the plugin's own code is accepted, at $101 to $3,133.70
Products and areas
Covered by Site Kit by Google
-
Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and it names both jax-ml/jax and openxla/xla at TIER_OT1: a product vulnerability anywhere in either repository is accepted, at $101 to $3,133.70
Products and areas
Covered by JAX and OpenXLA
-
Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and protocolbuffers/protobuf is named explicitly in the published tier file at TIER_OT0: a product vulnerability anywhere in the monorepo is accepted, at $500 to $7,500
Products and areas
Covered by Protocol Buffers
-
Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and the tensorflow org contributes five TIER_OT1 rows: tensorflow, serving, models, tfjs and tflite-micro. A product vulnerability anywhere in those repositories is accepted, at $101 to $3,133.70
Products and areas
Covered by TensorFlow
-
Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and the tier file names four Dart repositories at TIER_OT1: dart-lang/sdk plus the companions dart-lang/tools, dart-lang/test and dart-lang/build. A product vulnerability anywhere in those four is accepted, at $101 to $3,133.70
Products and areas
Covered by Dart SDK
-
Google's tier file names three repositories at OT0: bazelbuild/bazel, bazelbuild/bazel-central-registry and bazelbuild/continuous-integration. A product vulnerability anywhere in the three is priced at $500 to $7,500, and a compromise of the registry, the repositories or the release pipeline falls in the separate supply-chain category at $3,133.70 to $31,337
Products and areas
Covered by Bazel
-
Google's tier file names three repositories at TIER_OT0: tink-crypto/tink-cc, tink-crypto/tink-java and tink-crypto/tink-go. A security bug anywhere in that code is a product vulnerability the open-source VRP prices at $500 to $7,500, and those tier lines are what put a non-google/* org in scope at that rate
Products and areas
Covered by Tink
-
Google's tier file names two repositories: flutter/flutter at OT0, where a product vulnerability is priced at $500 to $7,500, and flutter/devtools at OT1, capped at $3,133.70. Both are covered whole, with no component of either carved out
Products and areas
Covered by Flutter
-
GPU driver bugs reachable from the renderer, which the rules describe as user-mode GPU driver bugs in Mesa or Mali drivers
Products and areas
Covered by Chromium
-
Hypercalls and the paravirtualised interfaces a guest can invoke directly, including asynchronous page faults, paravirtual EOI and steal-time accounting
Products and areas
Covered by kvmCTF (Linux KVM hypervisor)
-
Image, font and asset decoding paths reached from network content, including malformed media that reaches a decoder before any application check
Products and areas
Covered by Flutter
-
Installer and release artifacts, repository configuration, GitHub Actions workflows and release signing across all three repositories, which Google prices as the supply-chain category
Products and areas
Covered by Bazel
-
Instruction emulation and the MMIO paths, where guest-controlled bytes are decoded and acted on by host kernel code
Products and areas
Covered by kvmCTF (Linux KVM hypervisor)
-
JAX's public array surface and the tracing layer beneath it: jax.numpy, jax.lax, jax.scipy, random number generation, and the shape and dtype inference that runs behind all of them
Products and areas
Covered by JAX and OpenXLA
-
Key and keyset management in full: KeysetHandle, keyset serialisation and parsing, key derivation, key rotation, and the Registry and KeyManager machinery that resolves a key type to an implementation
Products and areas
Covered by Tink
-
Leaked credentials, sensitive write-access keys, or insecure configuration in Go's own repositories, which the OSS VRP treats as a standing top priority
Products and areas
Covered by Go
-
libcore, Android's java.* standard library implementation, serialization included
Products and areas
Covered by Android Runtime (ART) and libcore
-
libsharpyuv and the colour-conversion and rescaling helpers shipped alongside the decoder
Products and areas
Covered by libwebp
-
Local privilege escalation from an unprivileged user to root, demonstrated end to end by stealing the flag off the instance
Products and areas
Covered by kernelCTF (Linux kernel LTS)
-
MCP integration on both sides of the wire: the client toolsets ADK connects out with, and the MCP server ADK can expose
Products and areas
Covered by Agent Development Kit
-
Microdroid, the minimal guest OS AVF boots inside a protected VM, together with its payload loading and its own userspace
Products and areas
Covered by Android Virtualization Framework and pKVM
-
minijail0, the command-line tool that runs setuid root and is reachable by any local user, along with the libminijail API and preload hook that callers link against
Products and areas
Covered by minijail
-
Model and checkpoint loading: SavedModel, GraphDef and MetaGraph protobuf parsing, checkpoint restoration, and the function library those files carry
Products and areas
Covered by TensorFlow
-
Mozilla pays separately under its own line on third-party libraries incorporated into shipped client code, and libwebp is present in the Firefox tree at media/libwebp
Products and areas
Covered by libwebp
-
MSR and CPUID handling, the emulated interrupt controllers (local APIC, IOAPIC and PIC), and the emulated timers
Products and areas
Covered by kvmCTF (Linux KVM hypervisor)
-
Multi-agent composition: sub-agent delegation, agent transfer, and the sequential, parallel and loop workflow agents
Products and areas
Covered by Agent Development Kit
-
Namespace construction across user, pid, mount, network, IPC, UTS and cgroup namespaces, together with the uid and gid map writing that decides who the confined process runs as
Products and areas
Covered by minijail
-
Nested virtualization: the host's handling of a guest hypervisor's control structures, VMCS and VMCB state included
Products and areas
Covered by kvmCTF (Linux KVM hypervisor)
-
Netstack, the pure-Go userspace network stack: link layer, ARP, IPv4 and IPv6, ICMP, UDP, TCP state handling and reassembly, and the socket layer on top
Products and areas
Covered by gVisor
-
Novel exploitation techniques against any available environment, judged quarterly at Google's discretion and paid separately from the exploit ladder
Products and areas
Covered by kernelCTF (Linux kernel LTS)
-
OEM proprietary code and drivers shipped on eligible devices
Products and areas
Covered by Android and Google Devices Security Rewards
-
Pallas kernels, the foreign-function interface and custom-call registration, plus jaxlib, the native extension carrying them down into XLA
Products and areas
Covered by JAX and OpenXLA
-
Parcel and Parcelable serialization across the Android Framework. The rules name Parcel Mismatch as a qualifying gadget-chain class and name arbitrary code execution across privileged, unprivileged and constrained contexts as a qualifying impact
Products and areas
Covered by Android Runtime (ART) and libcore
-
Parser and resource-handling flaws reachable through importable packages: algorithmic-complexity or decompression-bomb denial of service, stack exhaustion from recursive parsing, XSS in html/template, and argument or PATH injection via os/exec
Products and areas
Covered by Go
-
Path-traversal and filepath-handling flaws, including Windows-specific behavior in path/filepath
Products and areas
Covered by Go
-
Platform channels and the method, event and message channel boundary between Dart and native code, the crossing from framework code into platform privileges
Products and areas
Covered by Flutter
-
Plugin update and release publishing to wordpress.org, which Google prices under its separate supply-chain category
Products and areas
Covered by Site Kit by Google
-
Privilege dropping: capability sets, ambient capabilities, securebits, no_new_privs, and the order in which all of it is applied
Products and areas
Covered by minijail
-
Randomness sourcing and nonce generation across all three bindings, including how a nonce is tracked and kept from repeating
Products and areas
Covered by Tink
-
Remote execution and remote caching clients, including action key derivation and the decision to trust a result computed on another machine
Products and areas
Covered by Bazel
-
Repository and release pipeline configuration, which Google prices under its separate supply-chain category
Products and areas
Covered by gVisor
-
Repository configuration and the npm release pipeline behind the @tensorflow/* packages, which Google prices under its separate supply-chain category
Products and areas
Covered by TensorFlow.js
-
Repository configuration and the release pipeline behind those images and packages, which Google prices under its separate supply-chain category
Products and areas
Covered by TensorFlow Serving
-
Repository configuration and the release pipelines behind the published packages, which Google prices under its separate supply-chain category
Products and areas
Covered by TensorFlow
-
Repository configuration and the release pipelines behind the published SDK artefacts, which Google prices under its separate supply-chain category
Products and areas
Covered by Dart SDK
-
Repository configuration and the release workflows that publish to Maven, PyPI, npm, NuGet, RubyGems and the Go module proxy, which Google prices under its separate supply-chain category
Products and areas
Covered by Protocol Buffers
-
repository configuration settings (e.g. GitHub actions, access control rules, GitHub application configurations)
Products and areas
Covered by Google Open Source Software VRP
-
Resource limits, covering rlimit and cgroup application and whether a restriction the caller asked for is enforced on the confined process
Products and areas
Covered by minijail
-
runsc: the OCI runtime and container lifecycle, bundle and config handling, the seccomp filter set it generates to constrain itself, checkpoint and restore, and its control socket
Products and areas
Covered by gVisor
-
SavedModel loading from local disk and from remote filesystems (GCS, S3, HDFS) through the TensorFlow filesystem plugins, together with the protobuf graph deserialisation underneath it
Products and areas
Covered by TensorFlow Serving
-
Security bugs in the Go standard library that break a documented security property, spanning crypto/*, encoding/*, net/http, path/filepath, os/exec, syscall, archive/*, and the rest of the stdlib, reported to the Go security team
Products and areas
Covered by Go
-
Serialisation and export: jax.export and jax.experimental.serialize, the StableHLO artifacts they emit, and the loader that turns one back into an executable computation
Products and areas
Covered by JAX and OpenXLA
-
Server-side rendering and hydration in @angular/platform-server, including the SSR state transfer that carries server-side data into the client bundle
Products and areas
Covered by Angular
-
Session, memory and artifact services, and every storage backend they ship with, from in-memory through database to the managed ones
Products and areas
Covered by Agent Development Kit
-
Site Isolation and the renderer sandbox across Windows, macOS, Linux, Android, ChromeOS and Fuchsia
Products and areas
Covered by Chromium
-
Supply-chain exposure across Go project infrastructure: the module proxy (proxy.golang.org), the checksum database (sum.golang.org), the vulnerability database tooling (vuln.go.dev), and Go's build and release infrastructure
Products and areas
Covered by Go
-
Template syntax and expression evaluation, including property, attribute, class and event bindings, and the control-flow blocks the compiler expands
Products and areas
Covered by Angular
-
tensorflow/serving model loading and version management, plus the gRPC and REST prediction endpoints it exposes to callers
Products and areas
Covered by TensorFlow
-
tf.io and tf.data: TFRecord reading, the image, audio and text decoders, the dataset pipeline ops, and the filesystem plugins including the remote ones
Products and areas
Covered by TensorFlow
-
tfjs-core itself, meaning the tensor abstraction, dtype and shape validation, and the op and kernel registry every backend dispatches through
Products and areas
Covered by TensorFlow.js
-
tfjs-node and tfjs-node-gpu, the Node bindings to the native TensorFlow C library, where the same inputs become native code on a server
Products and areas
Covered by TensorFlow.js
-
TFLite: flatbuffer model parsing, the interpreter and its built-in ops, and the delegates that hand work to accelerators
Products and areas
Covered by TensorFlow
-
The adk CLI, the local adk web UI, and the API server ADK stands up to serve an agent over HTTP
Products and areas
Covered by Agent Development Kit
-
The admin surfaces: nonce verification, capability checks, the settings and module activation flows, and the user and site option storage behind them
Products and areas
Covered by Site Kit by Google
-
The agent runtime: the runner loop, the event stream a turn produces, and the invocation context that carries state from one step to the next
Products and areas
Covered by Agent Development Kit
-
The app sandbox boundary as the runtime enforces it, which is what separates one installed application from another
Products and areas
Covered by Android Runtime (ART) and libcore
-
The arena allocator, lazy and unverified-lazy field handling, and the message copy, merge and swap paths
Products and areas
Covered by Protocol Buffers
-
The AVF crosvm build, the virtual machine monitor that constructs the guest and mediates its virtio device access
Products and areas
Covered by Android Virtualization Framework and pKVM
-
The batching scheduler and its request coalescing, where several callers' requests are merged into a single batch
Products and areas
Covered by TensorFlow Serving
-
The Bazel Central Registry: module metadata, the source archive integrity hashes it publishes, patch files, and the presubmit and publishing flow that admits a new module version
Products and areas
Covered by Bazel
-
The Bazel server and its client protocol, the build event service, and the persistent worker protocol
Products and areas
Covered by Bazel
-
The bindings as code rather than as a shared design: C++ memory handling in tink-cc, JNI and JCA interaction in tink-java, and the Go implementation, each carrying its own safety argument
Products and areas
Covered by Tink
-
The Blink rendering engine and the web platform it implements: DOM, CSS, layout, the HTML parser and the APIs a page can call
Products and areas
Covered by Chromium
-
The browser process, the network service, the GPU process, the utility processes, and the Mojo IPC layer that connects them
Products and areas
Covered by Chromium
-
The build engine end to end: loading, analysis and execution, the action graph, and the local sandbox implementations that are supposed to confine an action
Products and areas
Covered by Bazel
-
The built-in tools the framework ships, including the code-execution and shell tools, file and retrieval tools, and whatever sandboxing sits around them
Products and areas
Covered by Agent Development Kit
-
The C and C++ API surface exposed by libtensorflow, the Python bindings above it, and the custom-op and delegate registration paths
Products and areas
Covered by TensorFlow
-
The ChromeOS VRP takes any security issue affecting the ChromeOS ecosystem, and minijail is the confinement layer under essentially every non-Chrome ChromeOS process and every crosvm device. The rules name google.github.io/minijail by URL only to rule out documentation findings, which leaves code findings inside the program. One severity table applies, topping out at $30,000 for a single Critical
Products and areas
Covered by minijail
-
The companion OT1 repositories: the shared packages in dart-lang/tools, the package:test runner and the build_runner code-generation stack, all of which execute on developer machines and in CI
Products and areas
Covered by Dart SDK
-
The container and RIFF chunk parser that sizes everything downstream of it
Products and areas
Covered by libwebp
-
The contest declares one target: a live instance running the latest LTS Linux kernel with the Container-Optimized OS config. The code under test is the upstream GPL-2.0 kernel rather than a Google fork, and what pays is a working exploit that takes the flag off that instance
Products and areas
Covered by kernelCTF (Linux kernel LTS)
-
The core framework: change detection, the dependency injection container, and the template compiler together with the rendering code it emits
Products and areas
Covered by Angular
-
The core libraries the language ships with, including dart:core, dart:async, dart:isolate, dart:typed_data, dart:convert and dart:io, together with the bounds and range checks the native implementation enforces underneath them
Products and areas
Covered by Dart SDK
-
The Dart VM in full: the bytecode interpreter, the JIT and AOT compilers, the isolate model, the garbage collector, and the snapshot and kernel loaders a released binary runs on every launch
Products and areas
Covered by Dart SDK
-
The demuxer, the mux library and animated WebP frame assembly, covering ANMF and ANIM handling and the WebPAnimDecoder API
Products and areas
Covered by libwebp
-
The distributed coordination service that multi-host jobs speak between cluster nodes, and the repository and release pipelines behind the published wheels, which Google prices under its separate supply-chain category
Products and areas
Covered by JAX and OpenXLA
-
The engine shipped in the same repository, including dart:ui, the Skia and Impeller rasterisers, and text shaping
Products and areas
Covered by Flutter
-
the entire ChromeOS stack, including but not limited to supported hardware, firmware, OS components (Google and non-Google developed)
Products and areas
Covered by ChromeOS VRP
-
The evaluation harness and the deployment helpers that package an agent for a hosted runtime
Products and areas
Covered by Agent Development Kit
-
The extensions system, WebUI, the Omnibox, and the permissions and security UI surface, with URL spoofing and web-platform privilege escalation priced on their own rows
Products and areas
Covered by Chromium
-
The flutter CLI itself, including channel switching and the version and artifact management it performs
Products and areas
Covered by Flutter
-
The framework layers: widgets, rendering, gestures, animation, and the semantics tree assistive technology reads
Products and areas
Covered by Flutter
-
The front end and static tooling in the same repository: the parser, the common front end, the analyzer and the language server
Products and areas
Covered by Dart SDK
-
The gofer process, the containerd shim, and the GPU passthrough path where a sandboxed workload drives host driver interfaces
Products and areas
Covered by gVisor
-
The in-repo command-line tooling: dart, dart compile, dart test and the pub client, including package resolution and the archives it downloads and unpacks
Products and areas
Covered by Dart SDK
-
The JNI boundary and the Java-to-native transition, where managed guarantees stop applying and raw memory begins
Products and areas
Covered by Android Runtime (ART) and libcore
-
The KMS integrations that wrap and unwrap keysets, following the tink-java-awskms and tink-java-gcpkms patterns
Products and areas
Covered by Tink
-
The lossless VP8L decoder, including Huffman table construction and the colour-cache and predictor transforms
Products and areas
Covered by libwebp
-
The lossy VP8 decoder and its bitstream parser, driven entirely by attacker-supplied bytes
Products and areas
Covered by libwebp
-
The memory side: EPT and NPT, shadow paging, memslot management, and the translation from a guest physical address into host memory
Products and areas
Covered by kvmCTF (Linux KVM hypervisor)
-
The model-loading path end to end: tfjs-converter, the model.json reader and the binary weight-shard fetch, all of which pull from whatever URL the calling page hands the library
Products and areas
Covered by TensorFlow.js
-
The network fetching layer: http_archive, checksum verification, netrc and credential-helper handling, and proxy support
Products and areas
Covered by Bazel
-
The network surface in full: the gRPC PredictionService with Predict, Classify, Regress and MultiInference, the model-status and metadata services, and the REST/HTTP API that fronts all of them
Products and areas
Covered by TensorFlow Serving
-
The networking stack as configured, covering the socket layer, protocol handling and netlink
Products and areas
Covered by kernelCTF (Linux kernel LTS)
-
The ng CLI, @angular-devkit/build-angular, schematics, and the dev server and build pipeline in angular-cli
Products and areas
Covered by Angular
-
The PJRT runtime and its plugin interface: device memory management, buffer donation, executable caching, and the collectives used across devices
Products and areas
Covered by JAX and OpenXLA
-
The pKVM hypervisor in the Android common kernel: the EL2 code, the host-to-hypervisor call interface, stage-2 translation, and the memory donation and sharing rules that hold host, hypervisor and protected VM apart
Products and areas
Covered by Android Virtualization Framework and pKVM
-
The platform embedders for Android, iOS, macOS, Windows, Linux and the web, and the platform views that host native widgets inside a Flutter surface
Products and areas
Covered by Flutter
-
The platform layer that moves control between the Sentry and the host, covering systrap, KVM and ptrace
Products and areas
Covered by gVisor
-
The program's platform and software scope covers the device software stack "including but not limited to" Android Open Source Project code, which it names first. ART and libcore are AOSP code, and a single runtime bug is priced on the standalone row
Products and areas
Covered by Android Runtime (ART) and libcore
-
The protected VM boot path in packages/modules/Virtualization: pvmfw, the instance disk, and the measurement and attestation chain that establishes what is running inside a pVM
Products and areas
Covered by Android Virtualization Framework and pKVM
-
The protoc compiler front to back: .proto lexing and parsing, option and edition handling, the descriptor pool it builds, and the code it generates for each target language
Products and areas
Covered by Protocol Buffers
-
The React dashboard rendered inside wp-admin, its data fetching, and any markup it produces from an API response
Products and areas
Covered by Site Kit by Google
-
The reliability of the exploit itself, which is scored rather than assumed: exploit_repro has to report 90% or better before the stability bonus applies
Products and areas
Covered by kernelCTF (Linux kernel LTS)
-
The rest of the AOSP device software stack sits under the same declaration. This page covers the ART and libcore trees inside it
Products and areas
Covered by Android Runtime (ART) and libcore
-
The runtime under those kernels: the executor and session layer, the Grappler graph optimisation passes, shape inference, resource and variable handling, and the allocators
Products and areas
Covered by TensorFlow
-
The same platform and software scope as the AOSP entry, covering the whole device software stack with Android Open Source Project code named first, and pKVM boundary defeats called out separately as a qualifying impact in both directions
Products and areas
Covered by Android Virtualization Framework and pKVM
-
The seccomp-BPF policy compiler in full: policy-file parsing, include handling, argument-filter expressions, and the filter program actually emitted
Products and areas
Covered by minijail
-
The Sentry, gVisor's userspace kernel, in full: the whole syscall implementation surface, process and thread management, signal delivery, memory management and the time and vDSO paths
Products and areas
Covered by gVisor
-
The servable and source abstractions the repository exposes for custom loaders, which embedders extend to serve artefacts other than SavedModel
Products and areas
Covered by TensorFlow Serving
-
The servable core: the model server config parser, version policies, the server core and the aspired-versions manager that decide which artefact loads and when one is retired
Products and areas
Covered by TensorFlow Serving
-
The Starlark interpreter and everything it evaluates: BUILD files, .bzl files, WORKSPACE, MODULE.bazel, and repository rules that fetch and execute external content
Products and areas
Covered by Bazel
-
The surrounding packages in the monorepo, including tfjs-data and tfjs-react-native, and the conversion and inspection utilities shipped alongside them
Products and areas
Covered by TensorFlow.js
-
The tags and snippets the plugin injects into rendered pages, and the placement logic deciding when they appear
Products and areas
Covered by Site Kit by Google
-
The tensorflow_model_server binary itself, its command-line and config surface, and the container images released from this repository
Products and areas
Covered by TensorFlow Serving
-
The text-format and JSON mapping parsers and printers, which accept human-authored and web-sourced input directly
Products and areas
Covered by Protocol Buffers
-
The three repositories and the release pipeline behind them, which the program prices as a separate supply-chain-compromise category rather than as a product vulnerability
Products and areas
Covered by Tink
-
The transformations and the jaxpr representation they build and consume: jit, grad, vmap, pmap and shard_map, together with sharding and device placement
Products and areas
Covered by JAX and OpenXLA
-
The trap and emulation paths a guest reaches the hypervisor through, covering guest exits, MMIO handling and interrupt injection
Products and areas
Covered by Android Virtualization Framework and pKVM
-
The Trusted Execution Environment (TEE), Secure Elements (e.g., Titan M2), bootloaders, and device firmware (including SoC, MCU, and radio units)
Products and areas
Covered by Android and Google Devices Security Rewards
-
The virtual filesystem and every implementation behind it: the gofer client and the LISAFS protocol, tmpfs, procfs, sysfs, overlay, and the mount and path-resolution logic above them
Products and areas
Covered by gVisor
-
The web compilation backends, dart2js and dart2wasm, and the JavaScript and WebAssembly interop the generated output relies on
Products and areas
Covered by Dart SDK
-
The whole op kernel surface in tensorflow/core/kernels, reached with tensor shapes, dtypes and attribute values a caller supplies
Products and areas
Covered by TensorFlow
-
The whole PHP plugin as it installs on a WordPress site, across every module it ships: Analytics, Search Console, AdSense and Tag Manager, along with the other Google service integrations bundled with it
Products and areas
Covered by Site Kit by Google
-
Third-party components shipped with Chrome, which the rules name explicitly, giving PDFium and Skia as the examples
Products and areas
Covered by Chromium
-
Tier 1 : Any open source project that receives a security vulnerability report from Google (such as from Project Zero ) is eligible for patches which contribute towards fixing the vulnerability .
Products and areas
Covered by Google Patch Rewards
-
Tier 2 : Projects integrated into OSS-Fuzz (Note: Rewards apply to qualifying patches within integrated projects; new project integrations and fuzz harnesses are not eligible).
Products and areas
Covered by Google Patch Rewards
-
Tool registration and dispatch, covering function tools, the argument binding that turns model output into a real call, long-running tools and the agent-as-a-tool wrapper
Products and areas
Covered by Agent Development Kit
-
Toolsets generated from an OpenAPI specification, and the credential and auth handling that attaches a token to an outbound tool call
Products and areas
Covered by Agent Development Kit
-
Upstream KVM in the Linux kernel as Google runs it: a stock v6.1.74 LTS host on an Intel Xeon Gold 5222, with the target available built with CONFIG_KASAN enabled or disabled. You are connected to a Debian 12.5 guest on a v6.1.0-21 kernel with the default Debian config, and the finding has to cross from that guest into the host. 0-day only, demonstrated live against the instance
Products and areas
Covered by kvmCTF (Linux KVM hypervisor)
-
V8, covering the JavaScript and WebAssembly engines and the V8 sandbox, which the reward table prices on rows of its own
Products and areas
Covered by Chromium
-
virtualizationservice and virtmgr, the AVF userspace daemons that create, configure and supervise protected VMs for apps and system services, and the AIDL surface those callers arrive on
Products and areas
Covered by Android Virtualization Framework and pKVM
-
Vulnerabilities in the golang.org/x/... sub-repositories that are part of the Go project (for example x/crypto, x/net, x/text, x/tools)
Products and areas
Covered by Go
-
Web rendering output from both the CanvasKit and HTML renderers, and any markup the framework emits into the page
Products and areas
Covered by Flutter
-
Wire-format parsing and serialisation: varint decoding, length-delimited fields, legacy groups, packed repeated fields, unknown-field retention and the recursion and size limits
Products and areas
Covered by Protocol Buffers
-
XLA's front end: HLO and StableHLO text and proto parsing, the whole optimisation and layout pass pipeline, and code generation for the CPU, GPU and TPU backends
Products and areas
Covered by JAX and OpenXLA
-
zone.js, the async scheduling layer the framework's change detection is built on
Products and areas
Covered by Angular
No target matches. Try part of a host name, such as the company name.
Out of scope 166
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.appspot.com
Google Cloud VRP Google and Alphabet VRP
-
*.bc.googleusercontent.com
Google and Alphabet VRP Google Cloud VRP
-
*.blogspot.com
Google and Alphabet VRP
-
*.googleusercontent.com
Google and Alphabet VRP
-
Agent output that is merely wrong or undesirable, with no concrete security boundary crossed
Agent Development Kit
-
Already-patched 1-day bugs, since the program buys 0-days demonstrated live
kvmCTF (Linux KVM hypervisor)
-
AngularJS 1.x, which is end-of-life and does not appear in the tier file at any band
Angular
-
Any Google repository absent from the tier file, which sits at OT2 or OT3 and pays nothing for a product vulnerability
Dart SDK
-
Any other repository in the jax-ml, openxla or Google orgs that the tier file does not list, which pays nothing for a product vulnerability after the April 2026 rules update
JAX and OpenXLA
-
Anything below the High or Critical bar the scope sentence sets, along with low-quality submissions, which are capped at the $500 base amount regardless of the class of bug described
Chromium
-
Anything on the published Android threat-model non-bug list, closed as unactionable and ineligible for a reward
Android Virtualization Framework and pKVM
-
Anything privately disclosed to a third party before Google: the VRP states that such reports will typically not qualify for a reward
Tink
-
Anything short of a demonstrated, working exploit. A crash, a theoretical write primitive or a patch on its own does not qualify
kernelCTF (Linux kernel LTS)
-
Anything shown only against a locally built kernel rather than against Google's pinned instance
kvmCTF (Linux KVM hypervisor)
-
Anything that depends on unprivileged user namespaces, disabled on the instance since 1 July 2025 precisely because that surface was producing too many winning exploits
kernelCTF (Linux kernel LTS)
-
Anything you cannot reproduce on an in-support Google device, so a result that only holds on an emulator or an out-of-support handset does not qualify
Android Virtualization Framework and pKVM
-
API misuse by a hypothetical caller. A badly written policy in someone else's integration is that integration's defect, and the finding has to weaken a real confinement on ChromeOS
minijail
-
Application-level XSS in a site that happens to use TensorFlow.js but whose flaw is in the site's own code
TensorFlow.js
-
Applications written in Flutter rather than defects in the framework that ships to them
Flutter
-
Attacks that require a rooted device
Google Mobile VRP
-
Automated scanner or fuzzer output submitted without triage, a reproducer, or root-cause analysis
Go
-
Awards to researchers on a sanctions list, in a territory subject to sanctions, or located in Russia or Belarus, which Google states it cannot pay
TensorFlow.js Dart SDK TensorFlow Serving
-
Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue
Flutter Angular Agent Development Kit Bazel
-
Backend and server-side services, which route to the main Google VRP rather than to this program
Android Virtualization Framework and pKVM
-
Browser engine bugs, which belong to the browser vendor's own program rather than to the library running inside it
TensorFlow.js
-
Bugs in applications built with Angular rather than defects in the framework itself
Angular
-
Bugs that actually live in a downstream wrapper such as ImageMagick, Pillow, GD or a language binding, rather than in libwebp itself
libwebp
-
Bugs that are not actually present in a Go package (misattributed user-code issues)
Go
-
Build breakage, incorrect output and performance regressions that carry no security consequence
Bazel
-
CIDR blocks or IP ranges allocated to Google Cloud customers
Google Cloud VRP
-
Code on trunk less than seven days old, which has not reached any shipping channel
libwebp Chromium
-
Compiling or executing code the caller already controls, since that sits inside the trust boundary the framework assumes
JAX and OpenXLA
-
CPU, DRAM and other hardware-based issues, the Spectre, MDS and Rowhammer families among them, which are not rewarded here
kvmCTF (Linux KVM hypervisor)
-
Crashes a reboot recovers from, since the rules only treat a crash as a vulnerability where restart is not possible
minijail
-
Cryptanalysis of the standard primitives themselves with no Tink-specific exploitation path, which attacks the algorithm rather than this code
Tink
-
customer instances, databases, storage buckets, or applications
Google Cloud VRP
-
Debug-mode-only behaviour that is documented as insecure and disabled in release builds
Flutter
-
debugging features
Chrome Vulnerability Rewards
-
Defects that only reproduce on a plugin release wordpress.org no longer carries, since the program covers the latest versions
Site Kit by Google
-
Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions
Protocol Buffers gVisor Dart SDK TensorFlow Serving TensorFlow TensorFlow.js
-
Defects that only reproduce on a release the projects no longer ship, since the program covers the latest versions
JAX and OpenXLA
-
Denial of service against the sandbox itself where there is no escape and no impact on the host or other tenants
gVisor
-
Denial of service produced by legitimate load, as opposed to a single malformed request that takes the server down
TensorFlow Serving
-
Denial-of-service or panics with no security-relevant impact beyond a crash, and issues that only affect Go releases already fixed in the two most recent major versions
Go
-
Developer-machine-only issues in adk web absent a realistic attack path to reach them
Agent Development Kit
-
Developer-machine-only issues in the CLI dev server where you cannot describe a realistic attack scenario
Angular
-
Devices within 90 days of the end of their guaranteed security updates
Android Runtime (ART) and libcore
-
Documentation-only findings against google.github.io/minijail/, which the ChromeOS VRP rules name by URL as ineligible
minijail
-
Downstream misconfiguration of runsc by a platform operator rather than a defect in what runsc ships
gVisor
-
Downstream misuse of protobuf APIs that are documented to require already-sanitised input
Protocol Buffers
-
Duplicates and late entries: "Only the first submission for a vulnerability is eligible for a reward (per target)", and there is one paid slot per LTS kernel version
kernelCTF (Linux kernel LTS)
-
Encoder-only bugs with no decode path from untrusted input, since nobody feeds an attacker's bytes to the encoder
libwebp
-
Experimental features
Chrome Vulnerability Rewards
-
Experimental features, debugging features and unsafe browser flags, per the Chrome VRP's standard exclusions
libwebp
-
Experimental features, debugging features and unsafe flags, none of which represent a configuration users are exposed to
Chromium
-
Findings already subsumed by an entry in the Go vulnerability database, or documented as expected behavior in Go's published vulnerability-classification decisions
Go
-
Flutter itself (flutter/flutter), which Google rates OT0 and prices on its own entry rather than this one
Dart SDK
-
Generic upstream Linux kernel bugs without an Android-specific proof of concept, even where the code path is shared
Android Virtualization Framework and pKVM
-
Google backend services and server-side APIs, which belong to the separate Google and Alphabet VRP rather than to this program
Android Runtime (ART) and libcore
-
Google infrastructure, backend APIs, or server-side services interacting with these devices
Android and Google Devices Security Rewards
-
Google repositories the tier file does not name, which sit at OT2 or OT3 and pay nothing for a product vulnerability
TensorFlow.js TensorFlow Serving
-
Google Workspace products
Google Cloud VRP
-
Google's production environment, Borg
Google Cloud VRP
-
GPU vendor driver and CUDA bugs that merely surface through XLA and belong to the hardware vendor
JAX and OpenXLA
-
Hardcoded API keys
Google Mobile VRP
-
Host kernel bugs that gVisor does not mediate, which belong to the kernel rather than to the sandbox
gVisor
-
Individuals and entities in Russia or Belarus, who cannot be paid, along with anyone else the sanctions rules reach
Android Runtime (ART) and libcore
-
Insecure application configuration chosen by a downstream integrator
Angular
-
Insider-only risks, which the rules downgrade to credit rather than a reward
Bazel
-
io_uring and nftables, both disabled on the target for the same reason
kernelCTF (Linux kernel LTS)
-
Issues already covered by Android's published threat models and known-non-bug list
Android Runtime (ART) and libcore
-
Issues that only manifest with the device in Developer mode
minijail
-
Issues that require a malicious BUILD or MODULE.bazel file the developer already chose to run, absent a realistic non-maintainer attack path
Bazel
-
Issues that require an administrator account acting against their own site, since an administrator already holds the capability being bypassed
Site Kit by Google
-
Issues that require an already-privileged host operator, since that is inside the trust boundary
gVisor
-
Kernel subsystems outside KVM, which belong to kernelCTF or to the kernel's own security process rather than to this program
kvmCTF (Linux KVM hypervisor)
-
Kernel versions other than the LTS the instance is currently running, which rotates every two to four weeks on average
kernelCTF (Linux kernel LTS)
-
Key-management failures in the integrating application, such as a caller writing an unencrypted keyset to disk
Tink
-
Loading an intentionally malicious model, where the documentation already warns that models are code
TensorFlow
-
LTS-channel-only findings and hardware past its auto-update expiry, both outside the supported configuration the program pays on
minijail
-
Memory-corruption reports against tink-cc that arrive without OSS-Fuzz reproduction steps or a merged patch, since the program will not price them in that form
Tink
-
Memory-corruption reports filed without exact OSS-Fuzz reproduction steps against an existing fuzz target, including how to build the image, or an already merged patch
Dart SDK
-
Memory-corruption reports filed without exact OSS-Fuzz reproduction steps against an existing fuzz target, or an already merged patch
TensorFlow Serving TensorFlow.js
-
Memory-corruption reports in XLA submitted without exact OSS-Fuzz reproduction steps against an existing fuzz target, or a merged upstream patch
JAX and OpenXLA
-
Memory-corruption reports submitted without exact OSS-Fuzz reproduction steps against an existing fuzz target, or a merged upstream patch
gVisor TensorFlow
-
Memory-corruption reports that arrive without exact OSS-Fuzz reproduction steps against an existing fuzz target, or a merged upstream patch
Protocol Buffers
-
MiraclePtr-protected bugs
Chrome Vulnerability Rewards
-
MiraclePtr-protected use-after-free in non-renderer processes, which the program now records as PROTECTED under BRP-ASAN rather than as a security bug
Chromium
-
Model accuracy and adversarial-input research, which is ML robustness rather than a software vulnerability
TensorFlow.js
-
Model-behaviour and ML-safety research, which the program routes to the Google AI VRP rather than the OSS VRP
JAX and OpenXLA
-
Model-level adversarial-example and ML-robustness research, which is not a software vulnerability
TensorFlow
-
Model-poisoning and adversarial-example research, which is ML robustness rather than a software vulnerability
TensorFlow Serving
-
Non-Pixel OEM devices, which do not satisfy the hardware-reproduction requirement even when the underlying code is identical. The proof of concept has to run on the latest public build of supported Pixel, Nest or Fitbit hardware
Android Runtime (ART) and libcore
-
Numerical accuracy differences with no security consequence, which are correctness bugs rather than vulnerabilities
JAX and OpenXLA
-
Operator misconfiguration such as exposing the server to a network without authentication, which is documented behaviour rather than a defect
TensorFlow Serving
-
other Google Cloud products
Google AI VRP
-
Other open-source, non-proprietary, or third-party applications
Google AI VRP
-
Other plugins and themes installed alongside Site Kit, including interactions that only misbehave because of what the other plugin does
Site Kit by Google
-
Other repositories in the protocolbuffers org, which the tier file does not list and which pay nothing for a product vulnerability after the April 2026 rules update
Protocol Buffers
-
Other repositories in the tensorflow org beyond the five the tier file lists, which pay nothing for a product vulnerability after the April 2026 rules update
TensorFlow
-
other Tier 3 or Tier 4 applications
Google AI VRP
-
Payment to individuals in Russia or Belarus, which the program's sanctions screening blocks
Android Virtualization Framework and pKVM
-
Platform-specific bugs owned by Android or iOS rather than by Flutter's own code
Flutter
-
Prompt injection framed purely as model behaviour rather than as a failure of a framework control, which the program routes to the Google AI VRP instead
Agent Development Kit
-
Python-level API misuse by the caller rather than a defect in the framework
TensorFlow
-
QEMU vulnerabilities, excluded explicitly despite QEMU being the userspace half of the same stack
kvmCTF (Linux KVM hypervisor)
-
Recent acquisitions
Google Cloud VRP
-
Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees
TensorFlow Protocol Buffers Site Kit by Google gVisor JAX and OpenXLA
-
Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject
Agent Development Kit Flutter Bazel Angular
-
Reports filed outside bughunters.google.com with a Google Account, which the rules treat as typically not reward-eligible, and researchers in Russia or Belarus, whom sanctions screening bars from payment
minijail
-
Reports filed to the Google OSS VRP instead of the Chrome VRP, where libwebp's absence from the tier file means a product vulnerability pays nothing
libwebp
-
Reports that rely on highly improbable preconditions or unrealistic user interaction, and findings below the program's impact thresholds
Android Virtualization Framework and pKVM
-
Repositories in Google's GitHub orgs that the tier file does not list, which pay nothing for a product vulnerability after the April 2026 rules update
gVisor Site Kit by Google
-
Repositories the tier file does not name, and releases that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward
Flutter Angular Agent Development Kit Bazel
-
Resource-exhaustion crashes with negligible security impact under the project's own threat model
Protocol Buffers
-
Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue
gVisor Protocol Buffers JAX and OpenXLA Site Kit by Google TensorFlow
-
Secondary lockscreen bypasses
Google Mobile VRP
-
Server-side Google services, which route to the main Google VRP rather than to the Chrome program
Chromium
-
Shell reports filed without a proof of concept to reserve a timestamp, which the program treats as noise against your account rating
Android Virtualization Framework and pKVM
-
Site-owner misconfiguration of Google service permissions, which is a setup mistake rather than a plugin defect
Site Kit by Google
-
social engineering attacks
Google Open Source Software VRP
-
Social engineering, and issues only exploitable by someone who already has maintainer or commit access
Dart SDK
-
Speculative reports that do not demonstrate the bug actually manifesting in Chrome
Chromium
-
Speculative reports that do not demonstrate the bug manifesting in a shipping browser
libwebp
-
Submissions from Google employees and from employees of Google partner companies developing code for covered devices
Android Virtualization Framework and pKVM
-
Submissions that require a separately supplied KASLR base, which the 2026-04-30 rules removed as an option
kernelCTF (Linux kernel LTS)
-
TensorFlow core kernel bugs, which belong to the TensorFlow entry rather than to the model server
TensorFlow Serving
-
The Dart SDK and language runtime, which is a separate tier-file entry (dart-lang/sdk) with its own band
Flutter
-
The full-chain rung is capped by budget as well as by difficulty: only four exploit bonuses will be paid in 2026, so a fifth complete chain has no band left to land on
Chromium
-
The host-to-KVM direction, which is not the boundary this program prices
kvmCTF (Linux KVM hypervisor)
-
The hosted sitekit.withgoogle.com service itself, which is a Google web property under the main Google VRP rather than the open-source program
Site Kit by Google
-
The plugins in flutter/packages, which the tier file does not name, along with third-party packages published on pub.dev
Flutter
-
Third-party Angular component libraries, which are not Google-maintained and are not covered by the tier file
Angular
-
Third-party Bazel rulesets outside the bazelbuild organisation, which are not listed in Google's repository tier file
Bazel
-
Third-party container runtimes that are not gVisor
gVisor
-
Third-party or non-Go-project code; report those upstream first
Go
-
Third-party protobuf reimplementations such as protobuf.js or gogo/protobuf, which are not in the tier file
Protocol Buffers
-
Third-party pub.dev packages that Google does not own, which fall outside the tier file entirely
Dart SDK
-
Third-party TensorFlow distributions and vendor forks, which are outside the tier file
TensorFlow
-
Third-party Tink ports and reimplementations, which carry no tier-file line and therefore no price
Tink
-
Third-party tools and MCP servers the developer chose to connect, which are their authors' code and not the framework's
Agent Development Kit
-
Third-party websites
Google Cloud VRP
-
Tier3 or Tier4 acquisitions
Google AI VRP
-
Trustpilot
Google and Alphabet VRP
-
Typosquatting and dependency confusion, unless it actually compromises the distributed build artifacts
Protocol Buffers
-
Unreachable code paths, which the rules exclude outright: unreachable bugs do not qualify for reward
minijail
-
unsafe flags
Chrome Vulnerability Rewards
-
Upstream Linux kernel and generic Linux components, "unless the reporter provides a functional Proof of Concept demonstrating a direct, exploitable impact specifically on Android or Pixel-maintained modules"
Android Runtime (ART) and libcore
-
upstream Linux kernel or generic Linux components
Android and Google Devices Security Rewards
-
Variants of Strandhogg and Tapjacking
Google Mobile VRP
-
Vertex AI
Google AI VRP
-
Vertex AI and Gemini API service-side issues, which belong to the Cloud or AI VRP
Agent Development Kit
-
Vulnerabilities impacting ChromeOS on unsupported hardware or AUE devices.
ChromeOS VRP
-
Vulnerabilities in 3rd-party services or platforms used to maintain and build Google OSS (e.g. source code management systems, CI/CD systems, package managers)
Google Open Source Software VRP
-
Vulnerabilities in Android
ChromeOS VRP
-
Vulnerabilities in backend components and services
ChromeOS VRP
-
Vulnerabilities in Go applications or non-importable code, including anything in package main or an installable command, which sit outside the Go vulnerability database's scope
Go
-
Vulnerabilities in older releases available through our Long Term Stable (LTS) channel.
ChromeOS VRP
-
Vulnerabilities in the Chrome Browser that are not ChromeOS-specific (in Ash/Aura Shell)
ChromeOS VRP
-
Vulnerabilities in the third-party CI platforms Bazel uses, which the program rules place explicitly out of scope
Bazel
-
Vulnerabilities that allow access to non-sensitive media in external storage
Google Mobile VRP
-
Vulnerabilities that do not work on the latest available operating system version
Google Mobile VRP
-
Vulnerabilities that only manifest when the device is in Developer mode.
ChromeOS VRP
-
WebKit that impact Chrome on iOS
Chrome Vulnerability Rewards
-
WordPress core vulnerabilities, which belong to WordPress rather than to the plugin
Site Kit by Google
-
Zendesk
Google and Alphabet VRP
Recent changes
Reward and scope changes across every Google program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Google products, from the NVD.
-
CVE-2026-88059 Medium
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evalu
-
CVE-2026-88058 High
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped g
-
CVE-2026-88060 High
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's f
-
CVE-2026-88057 Medium
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or
-
CVE-2026-88056 High
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities
-
CVE-2026-69151 High
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 2
-
CVE-2026-69149 High
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). Th
-
CVE-2026-68945 High
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19
About this page
This page gathers every public program listed under google.com and the companies Google owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Google.
Something wrong or missing? Report a correction.