Free tools Windows power users keep installed
One-click scans. No signup required.
Google says it awarded $17.1 million through its vulnerability reward programs in 2025, paying 747 researchers. The company described the total as an all-time high and said it was more than 40% higher than in 2024. The $17 million figure in the headline is the rounded version of the more precise total shown in Google’s infographic.
How much did Google pay bug bounty researchers in 2025?
Google’s March 31, 2026 annual review reports more than $17 million in 2025 rewards; its infographic specifies $17.1 million. It also reports that 747 researchers received payments. Those are totals across Google’s vulnerability reward programs, not a promise that every submitted report earns money.
As an Amazon Associate I earn from qualifying purchases.
The infographic lists a highest reward of $250,000. That is the top award shown for the year, not a typical payout or an amount guaranteed for a particular vulnerability. It also puts Google’s cumulative rewards since 2010 at $81.6 million. Google’s 2025 review and infographic name Dirk Göhmann and Tony Mendez as authors.
How does the 2025 payout compare with 2024?
| Year | Google’s reported rewards | Researchers paid | Comparison note |
|---|---|---|---|
| 2024 | Just shy of $12 million | Over 600 | Google’s March 7, 2025 review described the annual total this way. |
| 2025 | $17.1 million in the infographic; described as over $17 million in the review | 747 | Google said the payout was more than 40% higher than in 2024. |
The figures indicate a larger annual payout and more researchers paid in 2025. Google’s stated comparison is “more than 40% increase compared to 2024”; the rounded 2024 and 2025 totals should not be used to claim a more exact growth rate. The 2024 review supplies the prior-year figures.
#1 Best Overall
An annual total does not show what an individual researcher typically earned, how many reports were submitted, or how effective the programs were. Google’s review does not provide a basis for those conclusions or a complete, comparable payout breakdown for every program.
What changed in Google’s reward programs during 2025?
Google runs a family of vulnerability reward programs rather than one bounty with a single scope. In 2025, the company highlighted changes across AI, Chrome, open-source tooling, and in-person hacking events.
A dedicated AI Vulnerability Reward Program
Google moved AI-related reports, previously organized under its Abuse VRP, into a dedicated AI Vulnerability Reward Program. The company says the new program included rule changes intended to make scope and rewards clearer.
Chrome AI and open-source tooling
Google added reward categories for issues in Chrome AI features. It also launched a patch rewards program for novel OSV-SCALIBR plugins that extend the open-source dependency scanner’s inventory, vulnerability, or secret detection.
Live hacking events
Google reported the following rewards associated with events during 2025:
| Event | Reported rewards |
|---|---|
| AI bugSWAT, Tokyo, April | Over $400,000 |
| Cloud bugSWAT, Sunnyvale, June | $1.6 million |
| bugSWAT Las Vegas, August | $380,000 |
| bugSWAT Mexico, alongside ESCAL8 | $566,000 “to date” |
These are event figures reported in Google’s annual review, not a separately established payout category to add on top of the $17.1 million annual total. Google’s extended Security Engineering post discusses individual VRPs, including Android, Abuse, AI, Cloud, Chrome, and open source.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does the payout mean for someone considering a report?
The totals show the scale of Google’s rewards in 2025, but they do not establish the likely earnings for a new participant. Eligibility, covered products, qualifying vulnerability types, and reward levels depend on the rules for the specific program and can change over time.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Google says its vulnerability reward programs began in 2010 and that 2025 marked their 15th anniversary. The Google Bug Hunters site provides current program rules and reporting pathways; consult those live rules before submitting a finding rather than relying on an annual recap.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
