Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

ChromeOS VRP

By Google Bug bounty on Self-hosted google.com

Accepting reports KYC to get paid
Go to program Website
Top reward
$500,000
Top severity paid
Critical
Assets in scope
3
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $500,000
for critical bugs, from $250.
Report as the policy says
The policy page explains how.
Payment
Proof of identity needed to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

Severity Reward
Critical $30,000 from $5,000
High $15,000 from $2,000
Medium $1,000 from $500
Top reward
$500,000 We have a standing $500,000 reward for exploit chains that compromise a Chromebook or Chromebox with device persistence in guest mode (i.e. guest-to-guest persistence with interim reboot, delivered via a web page).
Lowest reward
$250 We may choose to reward $250 for any report at any severity level that the panel believes has helped us improve the overall security posture of ChromeOS and the ChromeOS ecosystem.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

3 assets you may test, 6 excluded.

Domains 1

  • chromium.org

Hardware and IoT 1

  • Chromebooks or ChromeOS Flex devices on supported hardware running the latest available version of ChromeOS in our Stable, Beta, or Developer channels in verified mode

Products and areas 1

  • the entire ChromeOS stack, including but not limited to supported hardware, firmware, OS components (Google and non-Google developed)
Out of scope (6)
  • Vulnerabilities impacting ChromeOS on unsupported hardware or AUE devices.
  • Vulnerabilities in Android
  • Vulnerabilities in backend components and services
  • Vulnerabilities in older releases available through our Long Term Stable (LTS) channel.
  • Vulnerabilities in the Chrome Browser that are not ChromeOS-specific (in Ash/Aura Shell)
  • Vulnerabilities that only manifest when the device is in Developer mode.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from ChromeOS VRP's policy. "We" in these lines means the program, not this site.

While testing

  • Your testing must not violate any law, or disrupt or compromise any data that is not your own.
  • All bugs should be reported using the vulnerability form (report to ChromeOS VRP ).
  • If you are submitting a patch, please attach the files (individually, not in a zip file) to the bug report.
  • If applicable, provide fast responses to questions from security testers in no more than one week, and include all requested information.
  • Patches and POCs/exploits should be submitted with the bug report or shortly afterwards.
  • Participation in the program is restricted to individuals aged 18 and older.
  • Unless otherwise authorized in advance, in order to qualify for a reward, reports submitted to the VRP at any period of time may not utilize Alphabet proprietary, confidential, or need-to-know information.

Not accepted

  • Bugs that cause a crash, unless it is a full denial of service and restart is not possible or the bug can be exploited remotely without user interaction.
  • Duplicate issues or issues we would have fixed without the report.
  • Security bugs that are unreachable in ChromeOS.
  • Bugs disclosed publicly or to a third-party for purposes other than fixing the bug.
  • Issues where private keys used for testing purposes are present in public ChromeOS repositories are not eligible for a payout.
  • Submissions regarding public GitHub repositories for reports on publicly available documents or slides
  • Security weaknesses that are not the result of bugs.
  • Unreachable bugs do not qualify for reward.
  • Highly and Substantially mitigated issues are typically going to be considered low security severity, and will not qualify for reward.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 12 Nov 2026. Last checked 4 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.