What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Google really did pay a record bug bounty, but the exact amount was $605,000, not £500,000. The reward was paid on July 13, 2022, for an Android security vulnerability and reported by IT Pro on February 23, 2023. IT Pro converted the payment to approximately £503,000 at the time and rounded that figure in its headline.
Google’s Bug Hunters statistics, updated January 20, 2026, still list $605,000 as the company’s largest individual reward. That is different from Google’s $17.1 million total vulnerability-reward spending in 2025 and from the newer Android program’s advertised maximum reward of up to $1.5 million.
What happened
Google disclosed that it had paid $605,000 for an Android security vulnerability in 2022. It described the payment as its largest single bug-bounty reward at that point. The original coverage appeared on February 23, 2023, in IT Pro.
The recipient was publicly associated with the alias gzobqq. IT Pro reported that the same researcher had received Google’s most valuable reward in 2021 for an Android exploit chain tracked as CVE-2021-39698, which earned $157,000.
#1 Best Overall
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
The available announcement did not publish the full technical details of the $605,000 finding. It identifies Android as the affected product area, but does not establish whether the reward involved a particular component, exploit technique, or vulnerability chain.
Why the headline said £500,000
The official reward was denominated in US dollars. IT Pro said the $605,000 payment was worth about £503,000 at the time and rounded that conversion to “£500,000” in its headline. Sterling values change with exchange rates, so £500,000 is an approximate historical conversion, not Google’s official bounty amount.
| Figure | What it means |
|---|---|
| $605,000 | The actual single reward listed by Google |
| About £503,000 | IT Pro’s approximate conversion when it reported the payment |
| £500,000 | The rounded figure used in the 2023 headline |
What is known about the vulnerability
Only a limited description was made public. The finding affected Android and received the record payment, but the cited reporting does not disclose a complete exploit chain or technical write-up.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThat means it would be inaccurate to identify the bug as a confirmed Titan M flaw, remote-code-execution issue, zero-click attack, or other specific class without a separate primary disclosure. Responsible-disclosure programs commonly withhold exploitable details until users have received protection, and some technical information may never be published.
Rank #2
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
- DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
- CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
- PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
- BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.
Why Google pays six-figure rewards
Google’s reward decisions are not based on a single severity label. Its Google and Alphabet Vulnerability Reward Program rules take account of the affected product or domain, the security impact, the sensitivity of exposed data or actions, report quality, novelty, and whether another researcher has already reported the issue.
Examples from the general rules
- Remote code execution can receive up to $101,010 in the highest listed category before applicable modifiers.
- Unrestricted file-system or database access can receive up to $75,000.
- Serious logic flaws affecting sensitive information or critical actions can receive up to $50,000.
- Novelty bonuses are listed at $1,000 to $5,000, with exceptional report-quality modifiers available in some cases.
Those general figures do not necessarily explain every Android award. Mobile programs can apply product-specific schedules and exploit-chain incentives, so the $605,000 payment may reflect several elements of Google’s review rather than a standard table entry.
Historical Android ceilings
At the time of the original story, IT Pro described Android rewards of up to $1 million for a qualifying zero-click Titan M exploit with persistence and up to $500,000 for certain high-value Titan M data-exfiltration vulnerabilities. An additional bonus could apply to exploit chains affecting specified developer-preview versions.
These were maximum eligibility figures. They provide context for Android’s incentive structure but do not prove that the $605,000 reward involved Titan M or any one of those scenarios.
Rank #3
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
Is $605,000 still Google’s biggest bounty?
According to Google’s Bug Hunters key statistics, yes: $605,000 remains the largest individual reward listed in the January 20, 2026 update. The page also lists later Chrome rewards of $250,000, none higher than the Android record.
The careful wording is “Google’s listed record.” Public statistics cannot establish that no undisclosed payment has ever exceeded it, but the company’s current published figures have not replaced the $605,000 entry.
Why the newer $1.5 million figure does not break the record
Google announced updated Android and Chrome reward rules on April 30, 2026. The changes advertise a potential reward of up to $1.5 million for a qualifying zero-click, full-chain compromise of a Pixel device’s Titan M2 security component with persistence. The non-persistence equivalent was reported as up to $750,000 in contemporary coverage.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThe $1.5 million number is a maximum offered under the updated rules, not evidence that Google has paid that amount. A reward ceiling and a confirmed payment answer different questions: one describes what an eligible report might earn, while the other records money actually awarded.
Rank #4
- PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
- TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
- NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
- MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
- HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone
How Google’s annual payouts compare
Google’s 2025 Vulnerability Reward Program review said the company paid $17.1 million across its programs, more than 40% above the 2024 total. More than 700 researchers received rewards, and the highest individual reward during 2025 was $250,000.
That $17.1 million figure is an annual aggregate distributed among many researchers. It is not a single bounty and should not be described as a larger individual reward than $605,000. Google’s review put cumulative payments since 2010 at approximately $81.6 million, while the live statistics page later displayed $81,933,423 and 21,828 individual rewards. The difference reflects the separate reporting dates and snapshots.
What researchers should take from the record
Read the applicable rules first
Google operates different reward schedules for different products. Researchers should confirm that a target is in scope and identify the relevant Android, Chrome, or general VRP rules before testing.
Recommended Free Tools
Demonstrate impact safely
A report should include a reproducible proof of concept and explain what an attacker can actually access or control. Testing should avoid real users, third-party systems, and production data.
Best Value
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
- ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
- CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
- PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
- 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US
Do not treat severity labels as guarantees
Payment can be reduced or denied when a report is out of scope, duplicates an existing submission, lacks a workable demonstration, or does not meet program conditions. A high-impact theory alone does not guarantee a six-figure award.
Explain what makes the finding valuable
Clear reproduction steps, affected versions, attack prerequisites, security consequences, and a responsible-disclosure timeline help Google assess novelty and impact. The record payment shows the potential value of a difficult, well-supported mobile security discovery, not a standard price for any Android bug.
The bottom line
Google’s record single bug bounty was $605,000, paid in 2022 for an Android vulnerability and reported in 2023. The £500,000 headline was a rounded currency conversion. Google’s published statistics still list that payment as its largest individual reward, while $17.1 million describes total spending across 2025 and $1.5 million describes a newer maximum offer—not a confirmed payout.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
