Google ups cash rewards for security help

By Ken Presti, on Aug 17, 2012 8:02 AM
Filed under Security


Google has stacked an additional $US1000 ($A957) in bonuses to researchers who discover particularly exploitable bugs.

Google's Chromium Vulnerability Rewards Program has paid out more than $US1 million dollars of rewards for security researchers who have identified and reported Chromium security issues.

While the number of reports has fallen off in recent months, Google maintains that the reduction speaks to the enhanced security that the program has helped to develop.

The company is also adding another $US1000 on top of the base reward for bugs located in portions of the code base deemed to be stable, or areas where the defect rate appears to be low.

Add another $US1000 on top of the base reward if you can find vulnerabilities that extend beyond the Chromium platform. These might include "certain open source parsing libraries".

Payments are adjudicated by a special rewards panel that, at times, has approved overall rewards of $US10,000 for findings that were deemed to be especially significant. These could be for particularly impressive findings, or for something that in Hollywood circles might be described as a lifetime achievement award.

Google is throwing down specific challenges in several key areas, such as Nvidia, ATI and Intel GPU driver vulnerabilities, high or critical severity vulnerabilities in the respective Windows drivers that are demonstrated and triggered from a web page, and submissions on Chrome OS, particularly local privilege escalation exploits in Chrome OS via the Linux kernel.

Another example involves serious vulnerabilities in IJG libjpeg.

"For well over a decade, there hasn’t been a serious vulnerability against IJG libjpeg. Can one be found?" Google wrote in a statement.

The program also covers vulnerabilities in Adobe Flash as well as other well-known software such as the Linux kernel, various open-source libraries and daemons, X windows, etc.

The base reward is $US000 "for well-reported UXSS bugs, covering both the Chromium browser and also Adobe Flash." But, with the new bonus structure, the rewards are likely to increase to $US4000 in many circumstances.

This article originally appeared at

Follow us on Facebook and Twitter

Copyright © 2015 The Channel Company, LLC. All rights reserved.


Google ups cash rewards for security help
Top Stories
AFL star joins Melbourne's Broadband Solutions
Shaun Grigg starts second job at peak of footy career.
Amazon Web Services killing it: revenue up 64%
Cloud vendor also triples operating income.
WestConnex signs national reseller Viatek
Five-year deal with Sydney Motorway Corporation.
Sign up to receive CRN email bulletins
What's the most important factor when partnering with a new vendor?

Latest Comments
CRN Magazine

Issue: 347 | March 2016

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.