Google does not operate one universal bug-bounty rulebook. It runs several vulnerability reward programs (VRPs), each with its own eligible products, evidence standards, submission route and reward decisions. The first step is therefore to identify the Google product or repository involved and open the rules for that specific program.
Google Bug Hunters is the central ecosystem for these programs. It includes separate tracks for Google open-source software, first-party Android apps, Android and Google devices, and Chrome. A report that fits one track may be out of scope in another, so do not apply a reward amount, proof requirement or scope statement from one branch to the entire Google portfolio.
As an Amazon Associate I earn from qualifying purchases.
What Google’s vulnerability rewards program is
A vulnerability reward program gives security researchers a defined way to report security flaws to the company that owns or maintains the affected technology. Google’s programs can provide monetary rewards or public recognition when a report meets the applicable rules. The programs are designed to turn independent security research into actionable fixes rather than asking researchers to contact a generic support channel.
The important qualification is that “Google’s VRP” is an umbrella term. Google Bug Hunters presents a group of programs, not a single scope covering every Google website, cloud service, application, browser, device and open-source project. Each branch identifies its own assets, qualifying impact, evidence requirements and submission instructions.
#1 Best Overall
Google’s general VRP page does not establish a single portfolio-wide list of products, current payout schedule or universal reporting process that can safely be applied to every branch. Before testing or submitting anything, use the current rules for the product owner and program you have identified.
Why choosing the correct program matters
A security issue can look similar technically while being governed by different rules. A flaw in a Google-owned open-source repository is handled differently from a vulnerability in a first-party Android application. A Chrome browser bug is also distinct from a server-side issue in a Google service. The correct branch determines whether the target is eligible, what proof is expected and where the report should go.
Google’s main VRP branches
| Program branch | Eligible assets and focus | Evidence or reporting detail | Current dated detail |
|---|---|---|---|
| Google Open Source Software (OSS) VRP | Latest versions of software in Google-owned public repositories and selected repositories elsewhere | Reports should identify the repository and include technical details, affected version, impact, attack scenario and reproducibility information. A buildable proof of concept may be required where relevant. The rules direct researchers to Google’s vulnerability form. | Google announced stricter proof expectations for certain report types and tiers on March 19, 2026. |
| Mobile VRP | Eligible first-party Android apps developed or maintained by Google; eligible apps are limited to listed publishers or apps included in the program’s Tier 1 list | Use the Mobile VRP’s own scope and submission instructions rather than assuming every Android app with a Google connection qualifies. | Eligibility depends on the current publisher and Tier 1 listings. |
| Android and Google Devices Security Reward Program | A separately defined set of Android and Google device software and hardware targets | Reports must include a functional proof of concept and follow the program’s specified instructions. | The rules page says it was last updated in April 2026. |
| Chrome VRP | Vulnerabilities in the Chrome Browser | Chrome has its own reporting and proof requirements. The rules distinguish browser issues from server-side Google service vulnerabilities. | Use Chrome’s current rules for the browser version and issue type involved. |
This table is a routing aid, not a substitute for the live rules. Product ownership, eligible versions and evidence standards can change, and the branches do not share one reward table.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to report a Google security bug
The practical workflow is the same at a high level, but the details must come from the relevant branch.
- Identify the target and owner. Record the exact product, application, browser, device, service or repository affected. Confirm whether Google owns or maintains it and whether another company or open-source project is the actual owner.
- Select the matching VRP. Open the branch whose scope covers that asset. For example, an issue in a Google-owned public repository belongs in the OSS rules, an eligible first-party Android app belongs in Mobile VRP, and a Chrome browser flaw belongs in Chrome VRP. Do not infer eligibility from the product name alone.
- Read the branch’s exclusions and impact rules. Determine whether the behavior is a security vulnerability, whether the affected version is covered, and whether the impact meets that program’s threshold. A technically real bug can still be outside a program’s scope.
- Test safely and preserve evidence. Work only on assets and versions allowed by the rules. Keep the exact build or version, configuration, request sequence, logs, screenshots and other artifacts needed to reproduce the result. Avoid accessing other people’s data or causing disruption.
- Prepare an actionable report. Explain what happens, why it matters, how an attacker could trigger it, which versions are affected and how the security team can reproduce it. Include the required proof of concept, which may need to be functional or buildable depending on the branch.
- Use the designated submission route. The OSS rules direct researchers to Google’s vulnerability form and ask them to identify the repository. Android, Devices and Chrome branches specify their own instructions, so do not send every issue through the OSS route.
- Let the program assess the report. Google evaluates eligibility, severity, reproducibility and report quality under the selected branch’s rules. A submission is not a promise that the issue will be accepted or rewarded.
What an actionable report should contain
A report should allow an engineer who did not discover the bug to reproduce and assess it without guessing. Start with a short title that names the affected component and security impact. Then provide the environment: product or repository, version or build, operating system or device where relevant, account or privilege level and any configuration needed to trigger the issue.
Technical explanation
Describe the vulnerable behavior in plain technical language. Identify the input, endpoint, component or code path involved, what validation or authorization is missing, and the resulting security boundary crossed. Separate confirmed behavior from your interpretation. If you believe data can be read, code can be executed or privileges can be gained, show the observable evidence for that claim.
Attack scenario and impact
Explain who could exploit the issue, what access they would need and what they could achieve. A useful scenario connects the technical defect to a concrete consequence, such as bypassing an authorization check or compromising a protected process. Do not inflate impact beyond what your proof demonstrates; reward decisions depend in part on the actual impact.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Reproduction and proof
Give numbered reproduction steps with exact commands, inputs, URLs or UI actions when the program permits them. Include expected and actual results. Attach a minimal proof of concept that demonstrates the vulnerability without collecting unnecessary data or creating persistence.
The required form of proof differs by branch. The OSS rules call for reproducibility information and, where relevant, a buildable proof of concept. Android and Devices rules call for a functional proof of concept. Chrome has its own proof requirements. A text-only description may therefore be insufficient even when the underlying issue is valid.
Affected versions and fix context
State the first version in which you observed the problem and the latest version you tested. If you tested a patch or a newer release, say so. For OSS reports, name the exact repository. Version information helps the receiving team determine whether the issue is current, already fixed or present in a maintained branch.
Rank #3
How the OSS VRP differs from the other branches
The OSS VRP is centered on software in public repositories rather than a general list of Google consumer services. Its stated coverage includes the latest versions of software in Google-owned public repositories and selected repositories elsewhere. That wording makes repository identity and maintenance status central to eligibility.
The March 19, 2026 OSS update tightened proof expectations for certain report types and tiers. Higher-quality evidence, such as an OSS-Fuzz reproduction or a merged patch, is required in the situations described by that update. This is an OSS-specific change. It should not be copied into Android, Devices or Chrome submissions unless those programs’ own rules say the same thing.
When reporting an OSS issue, identify the repository in the vulnerability form and make the reproduction buildable where the applicable tier requires it. A patch can help the maintainers understand the fix, but submitting a patch does not by itself guarantee acceptance or a reward.
Mobile, Android and Devices, and Chrome: separate rule sets
Mobile VRP
The Mobile VRP focuses on first-party Android apps developed or maintained by Google. Eligibility is restricted to listed publishers or apps included in the program’s Tier 1 list. An Android application that merely integrates with a Google service, is distributed by another publisher or appears in an unrelated ecosystem is not automatically covered.
Check the current app and publisher list before testing. Record the package name, version and device or Android release used, then follow the Mobile VRP’s reporting instructions. Do not assume that a finding in an eligible app carries the same proof or payout rules as a finding in Android system software.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Android and Google Devices Security Reward Program
This program has a defined device and software scope and requires a functional proof of concept. The rules page was last updated in April 2026, so readers should verify the current target list and requirements before submitting. A functional demonstration should show the security effect on the covered device or software rather than merely pointing to suspicious code or a theoretical pathway.
Chrome VRP
Chrome VRP covers Chrome Browser vulnerabilities and has separate reporting and proof requirements. The rules distinguish browser issues from server-side Google service issues. If the browser is only the client used to reach a server flaw, route the report according to the service or program that owns the vulnerable server component rather than labeling it a Chrome bug.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Does Google pay for vulnerability reports?
Google’s programs may pay monetary rewards, but payment is discretionary and varies by branch. Published rules describe amounts as typical or discretionary and explain that decisions depend on factors such as impact and report characteristics. A vulnerability category, a claimed severity level or an advertised maximum is not a guaranteed payout.
Three practical consequences follow:
- Eligibility comes first. A report outside the selected program’s scope may receive no reward even if the behavior is technically interesting.
- Evidence affects assessment. Clear reproduction steps, a suitable proof of concept and a demonstrated security impact make it easier for the team to validate the report.
- Branch rules control the decision. Do not use a reward expectation from OSS, Mobile, Android and Devices or Chrome to predict the result in another program.
Recognition may also be available through the program ecosystem, but the form and criteria are controlled by the applicable rules. Treat any reward or recognition as an outcome of Google’s review, not as an entitlement created by submitting a report.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Common mistakes and how to avoid them
Using the wrong intake form
Sending an Android, Chrome or device issue through an unrelated route can delay triage or make the report appear out of scope. Confirm the branch before submission and follow its named channel.
Best Value
Assuming every Google-branded asset is covered
Google’s programs use defined scopes. The Mobile VRP, for example, limits eligible apps to specified first-party publishers or Tier 1 listings. Repository ownership, app publisher and product version all matter.
Submitting a theoretical claim without a working demonstration
Some branches explicitly require functional or buildable proof. Include the form of evidence the selected rules request, not merely a code excerpt or a statement that exploitation should be possible.
Overstating severity
Describe the demonstrated attacker capability and affected data or privileges. Inflated claims make triage harder and do not create a guaranteed reward.
Ignoring version and date information
Rules and eligible versions change. Include the exact build or release tested and check the current branch page immediately before reporting. The March 2026 OSS change and April 2026 Android and Devices update show why an older description may no longer be sufficient.
What to verify before you submit
- The exact product, repository, app, browser or device and its owner.
- The specific Google VRP branch that lists that target.
- The current version, publisher or repository eligibility condition.
- The branch’s definition of a qualifying security impact.
- The required proof format: functional, buildable or another form specified by the rules.
- The designated report form or submission route.
- A minimal reproduction that the receiving team can run safely.
- Your realistic expectations about a discretionary reward.
Because Google can revise scopes, proof standards and reward guidance, confirm these items on the applicable live rules page on the day you report.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
