In 2024, our Vulnerability Reward Program confirmed the continued worth of partaking with the safety analysis group to make Google and its merchandise safer. This was evident as we awarded simply shy of $12 million to over 600 researchers primarily based in nations across the globe throughout all of our applications.
Vulnerability Reward Program 2024 in Numbers
You may study who’s reporting to the Vulnerability Reward Program by way of our Leaderboard – and discover out extra about our youngest safety researchers who’ve lately joined the ranks of Google bug hunters.
VRP Highlights in 2024
In 2024 we made a sequence of modifications and enhancements coming to our vulnerability reward applications and associated initiatives:
-
The Google VRP revamped its reward construction, bumping rewards as much as a most of $151,515, the Cellular VRP is now providing as much as $300,000 for crucial vulnerabilities in top-tier apps, Cloud VRP has a top-tier award of up $151,515, and Chrome awards now peak at $250,000 (see the under part on Chrome for particulars).
-
We rolled out InternetCTF – to get rewarded, uncover novel code execution vulnerabilities in open supply and supply Tsunami plugin patches for them.
-
The Abuse VRP noticed a 40% YoY enhance in payouts – we acquired over 250 legitimate bugs focusing on abuse and misuse points in Google merchandise, leading to over $290,000 in rewards.
-
To enhance the fee course of for rewards going to bug hunters, we launched Bugcrowd as a further fee choice on bughunters.google.com alongside the prevailing normal Google fee choice.
-
We hosted two editions of bugSWAT for coaching, ability sharing, and, after all, some reside hacking – in August, we had 16 bug hunters in attendance in Las Vegas, and in October, as a part of our annual safety convention ESCAL8 in Malaga, Spain, we welcomed 40 of our prime researchers. Between these two occasions, our bug hunters had been rewarded $370,000 (and loads of swag).
-
We doubled down on our dedication to help the subsequent era of safety engineers by internet hosting 4 init.g workshops (Las Vegas, São Paulo, Paris, and Malaga). Comply with the Google VRP channel on X to remain tuned on future occasions.
Extra detailed updates on chosen applications are shared within the following sections.
Android and Google Gadgets
In 2024, the Android and Google Gadgets Safety Reward Program and the Google Cellular Vulnerability Reward Program, each a part of the broader Google Bug Hunters program, continued their mission to fortify the Android ecosystem, attaining new heights in each impression and severity. We awarded over $3.3 million in rewards to researchers who demonstrated distinctive ability in uncovering crucial vulnerabilities inside Android and Google cell functions.
The above numbers mark a big change in comparison with earlier years. Though we noticed an 8% lower within the complete variety of submissions, there was a 2% enhance within the variety of crucial and excessive vulnerabilities. In different phrases, fewer researchers are submitting fewer, however extra impactful bugs, and are citing the improved safety posture of the Android working system because the central problem. This showcases this system’s sustained success in hardening Android.
This 12 months, we had a heightened give attention to Android Automotive OS and WearOS, bringing precise automotive gadgets to a number of reside hacking occasions and conferences. At ESCAL8, we hosted a live-hacking problem targeted on Pixel gadgets, leading to over $75,000 in rewards in a single weekend, and the invention of a number of reminiscence security vulnerabilities. To facilitate studying, we launched a brand new Android hacking course in collaboration with exterior safety researchers, targeted on cell app safety, designed for newcomers and veterans alike. Keep tuned for extra.
We prolong our deepest gratitude to the devoted researchers who make the Android ecosystem safer. We’re proud to work with you! Particular because of Zinuo Han (@ele7enxxh) for his or her experience in Bluetooth safety, blunt (@blunt_qian) for holding the file for essentially the most legitimate studies submitted to the Google Play Safety Reward Program, and WANG,YONG (@ThomasKing2014) for groundbreaking analysis on rooting Android gadgets with kernel MTE enabled. We additionally respect all researchers who participated in final 12 months’s bugSWAT occasion in Málaga. Your contributions are invaluable!
Chrome
Chrome did some transforming in 2024 as we up to date our reward quantities and construction to incentivize deeper analysis. For instance, we elevated our most reward for a single difficulty to $250,000 for demonstrating RCE within the browser or different non-sandboxed course of, and extra if accomplished straight with out requiring a renderer compromise.
In 2024, UAF mitigation MiraclePtr was absolutely launched throughout all platforms, and a 12 months after the preliminary launch, MiraclePtr-protected bugs are not being thought of exploitable safety bugs. In tandem, we elevated the MiraclePtr Bypass Reward to $250,128. Between April and November, we additionally launched the primary and second iterations of the V8 Sandbox Bypass Rewards as a part of the development in the direction of the V8 sandbox, ultimately changing into a safety boundary in Chrome.
We acquired 337 studies of distinctive, legitimate safety bugs in Chrome throughout 2024, and awarded 137 Chrome VRP researchers $3.4 million in complete. The best single reward of 2024 was $100,115 and was awarded to Mickey for his or her report of a MiraclePtr Bypass after MiraclePtr was initially enabled throughout most platforms in Chrome M115 in 2023. We rounded out the 12 months by asserting the prime 20 Chrome VRP researchers for 2024, all of whom had been gifted new Chrome VRP swag, that includes our new Chrome VRP mascot, Bug.
Cloud VRP
The Cloud VRP launched in October as a Cloud-focused vulnerability reward program devoted to Google Cloud services and products. As a part of the launch, we additionally up to date our product tiering and improved our reward construction to higher align our studies with their impression on Google Cloud. This resulted in over 150 Google Cloud merchandise coming below the highest two reward tiers, enabling higher rewards for our Cloud researchers and a safer cloud.
Since its launch, Google Cloud VRP triaged over 400 studies and filed over 200 distinctive safety vulnerabilities for Google Cloud services and products resulting in over $500,000 in researcher rewards.
Our spotlight final 12 months was launching on the bugSWAT occasion in Málaga the place we received to fulfill lots of our superb researchers who make our program so profitable! The overwhelming constructive suggestions from the researcher group continues to propel us to mature Google Cloud VRP additional this 12 months. Keep tuned for some thrilling bulletins!
Generative AI
We’re celebrating an thrilling first 12 months of AI bug bounties. We acquired over 150 bug studies – over $55,000 in rewards to date – with one-in-six resulting in key enhancements.
Regulate Gen AI in 2025 as we give attention to increasing scope and sharing further methods for our researcher group to contribute.
In 2025, we will probably be celebrating 15 years of VRP at Google, throughout which we’ve remained absolutely dedicated to fostering collaboration, innovation, and transparency with the safety group, and can proceed to take action sooner or later. Our objective stays to remain forward of rising threats, adapt to evolving applied sciences, and proceed to strengthen the safety posture of Google’s services and products.
We need to ship an enormous thanks to our bug hunter group for serving to us make Google merchandise and platforms extra protected and safe for our customers all over the world – and invite researchers not but engaged with the Vulnerability Reward Program to affix us in our mission to maintain Google protected!
Thanks to Dirk Göhmann, Amy Ressler, Eduardo Vela, Jan Keller, Krzysztof Kotowicz, Martin Straka, Michael Cote, Mike Antares, Sri Tulasiram, and Tony Mendez.
Tip: Need to learn of latest developments and occasions round our Vulnerability Reward Program? Comply with the Google VRP channel on X to remain within the loop and make sure you try the Safety Engineering weblog, which covers subjects starting from VRP updates to safety practices and vulnerability descriptions (30 posts in 2024)!
