Google Revamps Bug Bounty Programs: Android Rewards Rise, Chrome Payouts Drop in the Age of AI

Key Points:

• Google has revamped its Vulnerability Reward Programs (VRP) for Android and Chrome, increasing rewards for high-impact vulnerabilities while decreasing payouts for others.
• The changes aim to prioritize actionable reports, focusing on vulnerabilities that are difficult for AI tools to detect, with the top reward for zero-click exploits on Android now at $1.5 million.
• Security researchers are encouraged to submit concise, verifiable reports with proof of concept and suggested fixes, as Google shifts its focus from quantity to quality in vulnerability submissions.

Technical Details: The overhaul reflects the impact of AI on vulnerability discovery, with Google emphasizing the need for actionable reports rather than lengthy descriptions. This includes a new focus on vulnerabilities affecting Google-maintained components.

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned: None mentioned