Google ups cash rewards for security help

By on
Google ups cash rewards for security help

Google has stacked an additional $US1000 ($A957) in bonuses to researchers who discover particularly exploitable bugs.

Google's Chromium Vulnerability Rewards Program has paid out more than $US1 million dollars of rewards for security researchers who have identified and reported Chromium security issues.

While the number of reports has fallen off in recent months, Google maintains that the reduction speaks to the enhanced security that the program has helped to develop.

The company is also adding another $US1000 on top of the base reward for bugs located in portions of the code base deemed to be stable, or areas where the defect rate appears to be low.

Add another $US1000 on top of the base reward if you can find vulnerabilities that extend beyond the Chromium platform. These might include "certain open source parsing libraries".

Payments are adjudicated by a special rewards panel that, at times, has approved overall rewards of $US10,000 for findings that were deemed to be especially significant. These could be for particularly impressive findings, or for something that in Hollywood circles might be described as a lifetime achievement award.

Google is throwing down specific challenges in several key areas, such as Nvidia, ATI and Intel GPU driver vulnerabilities, high or critical severity vulnerabilities in the respective Windows drivers that are demonstrated and triggered from a web page, and submissions on Chrome OS, particularly local privilege escalation exploits in Chrome OS via the Linux kernel.

Another example involves serious vulnerabilities in IJG libjpeg.

"For well over a decade, there hasn’t been a serious vulnerability against IJG libjpeg. Can one be found?" Google wrote in a statement.

The program also covers vulnerabilities in Adobe Flash as well as other well-known software such as the Linux kernel, various open-source libraries and daemons, X windows, etc.

The base reward is $US000 "for well-reported UXSS bugs, covering both the Chromium browser and also Adobe Flash." But, with the new bonus structure, the rewards are likely to increase to $US4000 in many circumstances.

This article originally appeared at

Copyright © 2017 The Channel Company, LLC. All rights reserved.

Most Read Articles

You must be a registered member of CRN to post a comment.
| Register


Does the government do enough to procure from local IT providers?
View poll archive

Log In

Username / Email:
  |  Forgot your password?