Google awarded $10 million in bug bounty rewards in 2023. The reward was awarded to 632 researchers from 68 countries for finding and responsibly reporting security flaws in the company’s products and services.
The highest reward in 2023 was $113,337. Google also awarded $3.4 million for vulnerabilities reported in the Android operating system. Google also increased the maximum reward amount for critical vulnerabilities concerning Android to $15,000 to increase community reports.
An additional $70,000 was awarded for 20 critical discoveries in Wear OS and Android Automotive OS, while another $116,000 was awarded for 50 reports concerning issues in Nest, Fitbit, and Wearables.
The company also awarded a bounty for 359 vulnerabilities detected in its Chrome browser, paying out a total of $2.1 million.
(For top technology news of the day, subscribe to our tech newsletter Today’s Cache)
Earlier in 2023, Google had announced it would triple bounty payments for sandbox escape chain exploits targeting Chrome until December. The program also increased rewards for bugs in older versions of Chrome’s Java Script engine, leading to significant discoveries and rewards like a $30,000 award for a long existing optimisation bug.
The cumulative sum of $10 million paid out by Google in 2023, was lower than the $12 million the company paid to researchers in 2022.
Google also ran a bugSWAT live-hacking event targeting LLM products that led to 35 reports being filed and more than $87,000 being awarded. Additionally, Google has published shared its criteria for bugs in AI products that aim to facilitate testing for traditional security vulnerabilities as as risks specific to AI systems.
