- Top reward
- $10,000
- Top severity paid
- High
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $10,000
- for high bugs, from $500.
- Report as the policy says
- The policy page explains how.
- Partial safe harbor
- Some legal protection; read the terms.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| High |
|
$5,000 from $500 |
- Top reward
-
$10,000
1) XSS [3] on extension origin │ $10,000 │ $5,000
- Lowest reward
-
$500
4) Other valid security vulnerabilities │ $500 - $7,500 │ $500 - $5,000
- Safe harbor
-
Partial
Of course, your testing must not violate any law, or disrupt or compromise any data that is not your own.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test.
Products and areas 3
- Extensions in the ”By Google” collection
- Extensions in the default-installed extension list
- The Perfetto UI extension
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Chrome Extensions VRP's policy. "We" in these lines means the program, not this site.
While testing
-
please, only ever target your own accounts.
-
Never attempt to access anyone else's data and do not engage in any activity that would be disruptive or damaging to your fellow users or to Google.
-
please do not attempt to carry out DoS attacks, leverage black hat SEO techniques, spam people, or do other similarly questionable things.
-
We also discourage the use of any vulnerability testing tools that automatically generate very significant volumes of traffic.
-
your testing must not violate any law, or disrupt or compromise any data that is not your own.
Not accepted
-
XSS mitigated by CSP is not in scope.
-
An unreasonable amount of user interactions will be out of scope for a reward.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.