2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010, our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under this umbrella contribute to the safety and security of Google and its users, but also highlighting their acceptance by the external research community, without which such programs cannot function.
Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer. This was more evident than ever as we awarded over $17 million (an all-time high and more than 40% increase compared to 2024!) to over 700 researchers based in countries around the globe – across all of our programs.
Vulnerability Reward Program 2025 in Numbers
Want to learn more about who’s reporting to the VRP? Check out our Leaderboard on the Google Bug Hunters site.
VRP Highlights in 2025
In 2025 we made a series of changes and improvements to our VRP and related initiatives, and continued to invest in the security research community through a series of focused events:
The new, dedicated AI VRP was launched, underscoring the importance of this space to Google and its relevance for external researchers. Previously organized as a part of the Abuse VRP, moving into a dedicated VRP has gone hand in hand with improvements to the rules, offering researchers more clarity on scope and reward amounts.
Similarly, the Chrome VRP now also includes reward categories for problems found in AI features.
We launched a patch rewards program for OSV-SCALIBR, Google's open source tool for finding vulnerabilities in software dependencies. Contributors are rewarded for providing novel OSV-SCALIBR plugins for inventory, vulnerability, or secret detection that expand the tool’s scanning capabilities. Besides strengthening the tool’s capabilities for all users, user submissions already helped us uncover and remediate a number of leaked secrets internally!
As part of Google's Cybersecurity Awareness Month campaign in October, we hosted our very own security conference in Mexico City, ESCAL8. The conference included init.g(mexico), our cybersecurity workshop for students, HACKCELER8, Google’s CTF finals, and a Safer with Google seminar, sharing technical thought leadership with Mexican government officials.
bugSWAT, our special invite-only live hacking event, saw several editions in 2025 and delivered some outstanding findings across different areas:
We hosted our first dedicated AI bugSWAT (Tokyo) in April which yielded a whopping 70+ reports filed and over $400,000 in rewards issued.
We continued the momentum in early summer with Cloud bugSWAT (Sunnyvale) in June resulting in 130 reports, with $1,600,000 in rewards paid out.
Next in line was bugSWAT Las Vegas in August, leading to 77 reports and rewards of $380,000.
And finally, as part of ESCAL8 in Mexico City, bugSWAT Mexico focused on many different targets and spaces including AI, Android, and Cloud, and resulted in the filing of 107 reports, totalling $566,000 in rewards to date.
Looking for more details? See the extended version of this post on the Security Engineering blog for reports from individual VRPs such as Android, Abuse, AI, Cloud, Chrome, and OSS, including specifics concerning high-impact bug reports and focus areas of security research.
What’s coming in 2026
In 2026, we remain fully committed to fostering collaboration, innovation, and transparency with the security community by hosting several bugSWAT events throughout the year, and following up with the next edition of our cybersecurity conference, ESCAL8. More broadly, our goal remains to stay ahead of emerging threats, adapt to evolving technologies, and continue to strengthen the security posture of Google’s products and services – all of which is only possible in collaboration with the external community of researchers we are so lucky to collaborate with!
In this spirit, we’d like to extend a huge thank you to our bug hunter community for helping us make Google products and platforms more safe and secure for our users around the world – and invite researchers not yet engaged with the Vulnerability Reward Program to join us in our mission to keep Google safe (check out our programs for inspiration 🙂)!
Thank you to Tony Mendez, Dirk Göhmann, Alissa Scherchen, Krzysztof Kotowicz, Martin Straka, Michael Cote, Sam Erb, Jason Parsons, Alex Gough, and Mihai Maruseac.
Tip: Want to be informed of new developments and events around our Vulnerability Reward Program? Follow the Google VRP channel on X to stay in the loop and be sure to check out the Security Engineering blog, which covers topics ranging from VRP updates to security practices and vulnerability descriptions!
No comments :
Post a Comment
Facts Only
Event: Vulnerability Reward Program's 15th anniversary (2025)
Origin: Established in 2010
Awards: Over $17 million to over 700 researchers worldwide
Locations: Countries globally
Initiatives: Dedicated AI VRP, improvements to the Abuse VRP, inclusion of reward categories for AI features in Chrome VRP, patch rewards program for OSV-SCALIBR, bugSWAT events, ESCAL8 conference in Mexico City
Executive Summary
Google's Vulnerability Reward Program (VRP) celebrated its 15th anniversary in 2025, a decade and a half since it was first established in 2010. The program has continually expanded over the years, highlighting its significant contributions to Google's security and user safety, as well as its acceptance by the external research community. In 2025, Google awarded over $17 million to more than 700 researchers worldwide, marking an all-time high and a 40% increase from the previous year.
Highlights of 2025 included the launch of a dedicated AI VRP, improvements to the rules for the Abuse VRP, the inclusion of reward categories for AI features in the Chrome VRP, and the initiation of a patch rewards program for OSV-SCALIBR. Google also hosted several bugSWAT events and its own security conference, ESCAL8, in Mexico City.
Full Take
Analyzing this article from a skeptical perspective, we find that it presents an informative account of Google's Vulnerability Reward Program and its achievements in 2025. However, it's important to note the potential for selective reporting or omission of less favorable outcomes. The article emphasizes the financial rewards given to researchers, but it does not discuss any potential challenges or criticisms faced by the program.
When examining Google's announcements of new initiatives like the AI VRP and the patch rewards program for OSV-SCALIBR, we should consider whether these developments are truly innovative or simply attempts to address perceived weaknesses in Google's security infrastructure. Furthermore, while bugSWAT events seem successful in uncovering vulnerabilities, it's crucial to assess their impact on overall system security and whether they can prevent future similar issues.
Finally, we should question the motives behind Google hosting its own security conference, ESCAL8, in Mexico City. While the event aims to share technical thought leadership with Mexican government officials, it may also serve as a means for Google to promote its security initiatives and strengthen its presence in the region.
Patterns detected: ARC-0024 Ambiguity (the article does not explicitly discuss potential challenges or criticisms faced by the VRP)
Sentinel — Human
The text exhibits signs of human authorship, characterized by variable sentence lengths, personal voice, and enthusiasm, which are indicative of a human journalist.