Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Google says it awarded $10 million to 632 researchers in 68 countries through its vulnerability reward programs in 2023. The total covered Google’s programs broadly—not just Chrome or AI—and its public year-end review names selected findings rather than publishing a complete list of rewarded bugs.
What Google’s $10 million covered
Google’s March 2024 review describes the $10 million as awards across its vulnerability reward programs. It says the researchers were based in 68 countries; Google’s later congressional testimony gives the more precise count of 632 paid researchers. The testimony also reports that the highest individual award exceeded $113,000 and that lifetime rewards had reached $59 million by the end of 2023. Google’s 2023 review and Google’s congressional testimony are the sources for those figures.
The annual total is not an AI-only figure or a payout for one event. It aggregates activity across programs that included Chrome, Android, devices, and generative AI, among others.
What researchers uncovered
A Chrome V8 optimization bug
Chrome’s Vulnerability Reward Program paid $2.1 million for 359 unique security bug reports in 2023. Google highlighted a V8 just-in-time (JIT) optimization bug that it said had been present since at least Chrome M91; the reporter received $30,000. The year-end post does not describe how the flaw could be exploited, so it does not establish that it was an actively exploited zero-day. Google also said it introduced a MiraclePtr bypass reward and full-chain exploit bonuses; the large full-chain incentives had not been claimed when the post was written. Google’s Chrome VRP summary
#1 Best Overall
Critical Android and device vulnerabilities
Google reported that Android VRP paid more than $3.4 million in 2023. At ESCAL8, a live-hacking event focused on Wear OS and Android Automotive OS, researchers found more than 20 critical vulnerabilities, for which Google paid $70,000. At separate hardwear.io security conferences, researchers reported more than 50 vulnerabilities across Nest, Fitbit, and Wearables, receiving $116,000. Google’s summary does not identify the individual flaws in these event totals. Google’s 2023 review
Prompt injection and data exfiltration in an AI report
At an LLM-focused bugSWAT event, Google received 35 reports and paid more than $87,000. Its review singled out a report titled “Hacking Google Bard – From Prompt Injection to Data Exfiltration,” as well as one titled “We Hacked Google A.I. for $50,000.” Those titles indicate the subjects Google chose to highlight, but the year-end summary does not provide technical reproductions or enough detail to independently characterize the underlying findings. Google’s generative-AI program summary
How the 2023 total compares with later years
The $10 million figure is historical, not Google’s current annual payout. Google’s later reviews report larger portfolio-wide totals, while using rounded or qualified figures:
| Year | Google’s reported total | Additional context |
|---|---|---|
| 2023 | $10 million | More than 600 researchers in 68 countries in the annual review; congressional testimony specifies 632 paid researchers. Annual review; testimony |
| 2024 | Just under $12 million | Google reported more than $3.3 million for Android and mobile vulnerabilities and $3.4 million for Chrome, with 337 valid unique Chrome bug reports. It also reported more than $500,000 in Cloud rewards after the program’s October launch and more than 150 AI reports with over $55,000 in rewards at the time of the review. These program figures should not be treated as exhaustive, mutually exclusive components of the annual total. Google’s 2024 review |
| 2025 | More than $17 million | Google said more than 700 researchers were paid; its accompanying infographic specifies 747 people, a highest reward of $250,000, and $81.6 million awarded since 2010. Google’s 2025 review |
Event-level figures in Google’s 2025 review—including bugSWAT totals—are subsets of the annual program activity, not additional money to add to the annual payout.
Rank #3
What Google’s public account does—and does not—show
The retrospective offers a sample of findings and program-level totals, not a public, bug-by-bug ledger. It does not disclose full technical reports for every rewarded vulnerability, and its brief summaries do not establish the precise exploitability or severity of every finding beyond the characterizations Google provides. The figures and examples above are therefore Google’s own published account, not an independent audit of private reports.
The review also describes program changes that shaped submissions and rewards: Google launched Mobile VRP for first-party Android applications, expanded exploit rewards through v8CTF, and added bonuses for selected targets. In May 2023, Google said critical Android vulnerabilities could qualify for rewards of up to $15,000 under the policy announced then; that historical maximum should not be read as a current rate. Its Android guidance encouraged accurate device and version details, root-cause analysis, a proof of concept, reproducibility, and evidence that the issue was reachable. Google’s May 2023 Android and device security post
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
