Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Android and Google Devices Security Rewards

By Google Bug bounty on Self-hosted google.com

Accepting reports
Go to program Website
Top reward
$1,500,000
Top severity paid
Not published
Assets in scope
8
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $1,500,000
top reward.
Report as the policy says
The policy page explains how.
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Top reward
$1,500,000 Titan M2 with Persistence │ Up to $1,500,000
Safe harbor
Partial Research must be conducted exclusively on devices you own or have explicit permission to test.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

8 assets you may test, 2 excluded.

Hardware and IoT 3

  • Fitbit Trackers and Smartwatches
  • Nest Cameras, Speakers, Displays, Thermostats, and Routers
  • Pixel phones, Pixel Tablets, and Pixel Watches

Domains 1

  • android.com

Source code 1

  • Android Open Source Project (AOSP) code

Products and areas 3

  • Android TV, WearOS, Android Automotive OS (AAOS), and GooglebookOS
  • OEM proprietary code and drivers shipped on eligible devices
  • The Trusted Execution Environment (TEE), Secure Elements (e.g., Titan M2), bootloaders, and device firmware (including SoC, MCU, and radio units)
Out of scope (2)
  • Google infrastructure, backend APIs, or server-side services interacting with these devices
  • upstream Linux kernel or generic Linux components

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Android and Google Devices Security Rewards's policy.

While testing

  • Research must be conducted exclusively on devices you own or have explicit permission to test.
  • You must not attempt to exploit or compromise the devices, accounts, or data of other users.
  • Testing must not negatively impact the availability or integrity of Google’s services or infrastructure.
  • If your research inadvertently accesses sensitive user data or proprietary infrastructure, you must halt testing immediately, delete any local copies of such data, and report the incident to Google.
  • A functional Proof of Concept (PoC) must be included with your initial report.
  • A proposed patch or root-cause code fix is mandatory for all memory safety vulnerabilities.

Not accepted

  • Generic Linux Vulnerabilities
  • Backend Services
  • phishing
  • theoretical attack paths
  • speculative assumptions
  • raw, un-minimized fuzzer crashes
  • incomplete "shell" reports

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 4 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.