Google has announced a new Bug Bounties platform and community designed to host all its Vulnerability Rewards Programs (VRP) under the same roof.
In all, Google says that the researchers have been rewarded $29,357,516 since January 2010, when it launched the Chromium vulnerability reward program.
Reward amounts paid for qualifying bugs through Google’s VRPs range from $100 to $31,337, however, the total amount can drastically increase for exploit chains.
This is exactly what happened in the case of Alpha Lab’s Guang Gong who received a $201,337 payout for a remote code execution exploit chain targeting Pixel 3 devices, his reward being the biggest single payout ever.
“To celebrate our anniversary and ensure the next 10 years are just as (or even more) successful and collaborative, we are excited to announce the launch of our new platform, bughunters.google.com,” Google said.
“This new site brings all of our VRPs (Google, Android, Abuse, Chrome, and Play) closer together and provides a single intake form that makes it easier for bug hunters to submit issues.”
Google Bug Bounties
The new VRP platform should provide researchers with per-country leaderboards, healthier competition via gamification, awards/badges for specific bugs, and more opportunities for interaction.
Google also launched a new Bug Hunter University, which would allow bug hunters to brush up on their skills or start a hunting learning streak.
The company says that patches submitted for open-source software are also eligible for rewards, just as research papers on the security of open-source projects.
“Since its inception, the VRP program has not only grown significantly in terms of report volume, but the team of security engineers behind it has also expanded – including almost 20 bug hunters who reported vulnerabilities to us and ended up joining the Google VRP team,” Google added.
“That is why we are thrilled to bring you this new platform, continue to grow our community of bug hunters and support the skill development of up-and-coming vulnerability researchers.”
If you find it interesting, you can read: