Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Google does not operate one universal bug-bounty rulebook. Its Vulnerability Reward Programs (VRPs) are a group of programs for different products and codebases, including Android, Chrome, Google devices, mobile apps and open-source software. To qualify for a reward, first identify the affected product and submit under the matching program’s current rules. Scope, proof requirements, reporting instructions and payment decisions differ between branches.
What Google’s vulnerability rewards program is
A Google VRP gives security researchers a formal way to report qualifying vulnerabilities to the team responsible for a Google product or project. A report can lead to a monetary award, recognition or both, but payment is not automatic. Each branch evaluates submissions under its own scope and criteria.
The Google Bug Hunters ecosystem includes dedicated programs rather than a single portfolio-wide set of terms. Android, Chrome, Google devices, eligible first-party Android applications and open-source repositories each have separate rules. A flaw that qualifies in one branch may be out of scope in another, even if the technical weakness looks similar.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The general Google VRP’s current universal scope and payout schedule are not established here. Do not transfer a reward amount, severity rule or submission procedure from one branch to every Google service. Use the live rules for the specific product before testing or reporting.
#1 Best Overall
How to choose the correct Google program
Program selection is the first substantive step. Identify who owns the affected asset, then match it to the branch whose rules cover that asset.
Google OSS VRP
The Google OSS VRP covers the latest versions of software in Google-owned public repositories and selected repositories elsewhere. Its rules focus on vulnerabilities in the covered code, not on every project that happens to use Google technology. The report should identify the repository and explain which version is affected.
Mobile VRP
The Mobile VRP focuses on eligible first-party Android applications developed or maintained by Google. Eligibility is restricted to publishers or applications listed by the program, including its Tier 1 list. An Android app is therefore not automatically eligible simply because it is available through an Android app store or communicates with a Google service.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Android and Google Devices Security Reward Program
This branch has a defined device and software scope. Its rules cover particular Android and Google device components rather than every Android handset or accessory. The rules require a functional proof of concept and were last updated in April 2026.
Chrome VRP
The Chrome VRP is for vulnerabilities in the Chrome Browser. Its rules and reporting process are separate from other Google programs. Chrome browser issues must not be confused with server-side vulnerabilities in a Google service; those belong under the applicable service or security program instead.
Rank #2
- Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities
- No Starch Press
- ABIS BOOK
Other Google services
If the target is a Google web service, cloud component or product not clearly covered by the branches above, consult the applicable current Google security or vulnerability-reward rules. Do not assume that a general policy, a Chrome rule or an Android rule applies to it.
How to report a Google security bug
A useful submission lets the responsible team reproduce the issue, understand its impact and decide whether it meets that branch’s reward criteria. Follow this sequence.
Recommended Free Tools
- Identify the asset and owner. Record the exact product, service, application, browser component, device model or public repository. Note the version, build or commit where the problem occurs. Ownership determines which program’s scope applies.
- Read the matching branch rules. Check the eligible products, excluded behavior, severity definitions, proof requirements and reporting route for that program. Confirm that the version you tested is covered; “Google-related” is not a sufficient scope test.
- Confirm the security impact. Describe what an attacker can actually achieve, such as unauthorized access, code execution, data disclosure, privilege escalation or another security consequence. Separate a theoretical weakness from a demonstrated attack path.
- Build a reproducible case. Include the setup, prerequisites, inputs, commands or UI actions, observed result and expected secure behavior. State whether the issue reproduces consistently and identify any account, device, network or configuration requirements.
- Prepare the required proof of concept. Use the format specified by the branch. The OSS rules request reproducibility information and, where relevant, a buildable proof of concept. Android and Devices reports require a functional proof of concept. A screenshot or claim without an executable or otherwise working demonstration may not satisfy those rules.
- Submit through the designated route. The OSS rules direct researchers to Google’s vulnerability form and require the repository to be identified. Other branches specify their own submission instructions. Use the route named by the applicable program rather than sending the report to an unrelated product team.
- Preserve a clear evidence trail. Include affected versions, logs, crash data, minimal test code and remediation context when safe to share. Remove secrets and personal data that are not necessary to reproduce the vulnerability.
- Respond to follow-up questions. The reviewing team may need clarification, a smaller reproduction or a test against a patched build. Keep the original conditions and version information available so you can answer precisely.
What a strong proof of concept contains
Proof requirements are branch-specific, but a reviewer generally needs more than a vulnerability label. A practical report should connect the technical defect to an observable security result.
For open-source reports
- Repository name and exact affected version, commit or release.
- Build or environment instructions that another engineer can follow.
- The vulnerable input, code path or configuration.
- Commands, test cases or a buildable demonstration where the rules call for one.
- Observed impact and the attacker capabilities required.
- Information showing reproducibility, including whether the issue persists in the latest version.
The March 19, 2026 OSS VRP update raised the evidence bar for certain report types and reward tiers. For those cases, higher-quality proof such as an OSS-Fuzz reproduction or a merged patch is required. That change applies to the OSS program; it should not be applied automatically to Android, Chrome or other branches.
For Android and Google Devices reports
The Android and Devices rules call for a functional proof of concept. Demonstrate the behavior on an eligible device or software component, identify the affected build and show the security consequence. A conceptual description, a non-security crash or a demonstration that cannot be run under the stated conditions may not meet the program’s requirement.
For Chrome reports
Use the Chrome branch’s own proof and reporting instructions. Identify the browser version, operating conditions and user interaction required. Make clear whether the issue is in the Chrome browser itself; a server-side Google service issue follows a different route.
What products are in scope?
There is no single product list that safely answers this question for every VRP. Scope is defined by branch and can change as products, repositories and rules change.
| Program branch | Eligible asset focus | Proof emphasis | Important qualification |
|---|---|---|---|
| Google OSS VRP | Latest versions in Google-owned public repositories and selected additional repositories | Technical detail, affected version, impact, attack scenario, reproducibility and a buildable proof of concept where relevant | Some report types and tiers have stricter evidence requirements after the March 19, 2026 update |
| Mobile VRP | Eligible first-party Android apps developed or maintained by Google | Follow the mobile program’s current requirements | Eligibility is limited to listed publishers or applications, including the Tier 1 list |
| Android and Google Devices | Defined Android device and software scope | Functional proof of concept | Rules last updated in April 2026; scope is not all Android hardware |
| Chrome VRP | Chrome Browser vulnerabilities | Use Chrome’s separate proof and reporting requirements | Chrome browser issues are distinguished from server-side Google service issues |
When a table cell says a requirement is branch-specific, that is deliberate: the available public material does not establish one cross-program rule. Verify the current page for the target before relying on any example.
Does Google pay for vulnerability reports?
Google VRPs may pay monetary rewards, but awards are discretionary and vary by program. Published rules describe amounts as typical or discretionary rather than guaranteed. A vulnerability category or a stated maximum does not create an entitlement to that amount.
Reviewers can consider impact, exploitability, quality of the reproduction, clarity of the report, affected version, program scope and other characteristics described in the branch rules. A report that is technically valid but difficult to reproduce may receive a different decision from a precise, well-supported report. Some submissions can receive recognition without a monetary award, depending on the applicable program.
Do not calculate expected income by multiplying a severity label by a published figure. The only reliable payment expectation is that the program will evaluate the report under its current discretionary rules.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes that make reports fail
Submitting to the wrong branch
A Chrome report, an Android application report and an open-source library report can have different owners and intake systems. Start with the asset, not with the vulnerability class.
Assuming every Google product is covered
Being hosted by, integrated with or branded as Google does not by itself establish eligibility. Check the named product, repository or application list and any exclusions.
Providing an unrepeatable demonstration
Missing versions, setup steps, credentials, device details or input data force the reviewer to guess. State every prerequisite and reduce the case to the smallest reliable reproduction.
Confusing a crash with a security impact
A crash can be useful evidence, but explain the security consequence and attacker-controlled conditions. If the effect is denial of service only, say so; do not imply code execution or data access without proof.
Ignoring the 2026 OSS evidence change
For OSS report types covered by the March 19, 2026 update, an older style of proof may no longer satisfy the relevant tier. Check whether an OSS-Fuzz reproduction, merged patch or another specified artifact is required.
Reporting sensitive data unnecessarily
Share only what the team needs to validate the issue. Redact credentials, personal records and unrelated user information while retaining enough evidence to reproduce the behavior.
A practical pre-submission checklist
- The affected asset, owner and program branch are identified.
- The tested version, build, commit or device model is recorded.
- The issue is within the branch’s current published scope.
- The attack prerequisites and realistic impact are explained.
- Reproduction steps work from a clean setup.
- The proof matches the branch: buildable where required for OSS, functional for Android and Devices, and compliant with Chrome or mobile instructions where applicable.
- The designated reporting form or route is used, with the repository or product named.
- Secrets and unrelated personal data are removed.
- The report does not assume a guaranteed reward.
How to keep the rules current
Google’s VRP terms can change independently. The dated material available for this guide includes the OSS update of March 19, 2026, and Android and Devices rules last updated in April 2026. Before testing a live target or relying on a reward expectation, open the current rules for that exact branch and recheck scope, proof, reporting and award language.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe durable principle is simple: identify the asset, select its program, produce evidence that the responsible team can reproduce, and let that program’s current rules determine eligibility and any reward.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
