During 2023 , Google gave away $10 million to 632 researchers from 68 countries as part of its bug bounty programs . Essentially, the company rewarded researchers for reporting security vulnerabilities in various of its products and services.
This amount is significant and demonstrates the high level of participation of the research community in efforts to strengthen the security of Google products.
The highest reward given by Google for reporting a vulnerability was $113,337, while the total since the program in 2010 reaches $59 million.
For Android security , the program has awarded more than $3.4 million . Last year, Google increased the maximum reward amount for critical vulnerabilities in Android (to $15,000), leading to increased reports from researchers.
See also: Microsoft: Announces bug bounty program for Defender
During security conferences like ESCAL8 and hardwea.io, Google awarded $70,000 for 20 critical discoveries in Wear OS and Android Automotive OS. In addition, it awarded $116,000 for 50 reports of security vulnerabilities in Nest, Fitbit, and Wearables.
As for the Chrome browser, there were 359 bug reports that offered a total of $2.1 million to researchers. On June 1, 2023, Google announced that it would triple bug bounty payments for sandbox escape chain exploits targeting Chrome, until December 1, 2023.
Additionally, bounties for bugs in older (pre-M105) versions of V8, JavaScript engine . One researcher received $30,000 for reporting an old (from M91) V8 JIT optimization bug.
It is worth noting that Google had introduced “MiraclePtr” in Chrome M116, to protect against non-renderer Use-After-Free (UAF) vulnerabilities. After introducing MiraclePtr, Google introduced a separate category of rewards for bypassing the protection.
See also: HackerOne: Has given away over $300 million in bug bounty programs
Finally, the company has also emphasized the security of AI products, such as Google Bard. In 2023, there were 35 reports of a bugSWAT live-hacking event that resulted in $87,000 in rewards.
Bug Bounty programs offer companies the opportunity to identify and fix security vulnerabilities in their systems before they are exploited by malicious users. Prompt reporting leads to bug fixes and strengthens the company's protection from potential cybersecurity.
Additionally, bug bounty programs allow companies to benefit from the experience and knowledge of a wider network of cybersecurity experts. Researchers from all over the world participate in such programs.
Google and other companies are increasingly placing importance on bug bounties, as they also improve their image in the eyes of customers and investors. They show that the company takes cybersecurity and does everything possible to protect its products.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Microsoft: New bug bounty program for AI-powered Bing
Finally, Bug Bounty programs can be cost-effective, as companies only pay for actual findings and not for the time or effort spent searching for vulnerabilities.
Source: www.bleepingcomputer.com
