Google’s Vulnerability Reward Programs paid researchers a record $8,700,000 in 2021, and researchers donated more than $300,000 of their rewards to charities. The total combined payouts across Google programs; it was not a bounty for a single vulnerability. Google published the figures on February 10, 2022, in its review of calendar-year 2021 results. Google’s 2021 review.
How Google’s $8.7 million payout was divided
The figures below are Google’s reported 2021 payouts. Program totals and report counts measure different things, so they should not be added together as though each described the same category.
| Program | Google’s 2021 result |
|---|---|
| Android | Nearly $3 million in rewards; the highest reported Android payout was $157,000 for an exploit chain. Google said its $1.5 million Titan-M prize remained unclaimed in the 2021 review. Google, 2021 review. |
| Chrome | $3.3 million for 333 unique Chrome security reports submitted by 115 rewarded researchers. Google attributed $3.1 million to Chrome Browser bugs and $250,500 to Chrome OS bugs. Google, 2021 review. |
| Google Play | $550,000 paid to more than 60 unique security researchers. Google, 2021 review. |
| Android Chipset Security Reward Program | $296,000 paid for more than 220 valid and unique reports. Google, 2021 review. |
The Titan-M figure was a prize on offer, not money paid out in 2021. It is therefore distinct from the reported Android rewards and should not be counted as a payout.
What the figures say about Google’s programs
The annual $8.7 million total represents rewards across Google’s Vulnerability Reward Programs, which invite outside researchers to identify security vulnerabilities so they can be addressed. The program-level figures show activity across Android, Chrome, Google Play, and chipset security, while Chrome’s report and researcher counts offer a more specific measure of submissions and rewarded participants.
#1 Best Overall
Google also said researchers donated more than $300,000 of their 2021 rewards to charities of their choice. That donation amount is part of the story about how recipients used their rewards; it is not an additional payout on top of the $8.7 million.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to report a vulnerability to Google
For a current vulnerability report, use Google’s security reporting portal at bughunters.google.com/report. Google launched bughunters.google.com in 2021 as a consolidated portal with a single intake form for its programs. It also described Bug Hunter University as learning content for researchers. Program eligibility and reward amounts can change, so check the live rules and reporting guidance before submitting; the figures in this article describe 2021 only.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
