In 2025, Google paid a record $17.1 million in bug bounties to security researchers through its Vulnerability Reward Program (VRP). This marks an all-time high for the company and a 40% increase compared to the $11.8 million awarded in 2024. 

2025 Payout Highlights

• Total Participants: Rewards were distributed to 747 researchers globally.
• Highest Single Reward: The largest individual payout reached $250,000.
• AI Security Focus: Google launched a dedicated AI Vulnerability Reward Program in 2025, which has already paid out over $430,000 for AI-related security flaws.
• Program Growth: Since its inception in 2010, the VRP has awarded more than $81.6 million to the research community. 

Performance by Program

• Google Cloud: The Cloud VRP awarded approximately $2.5 million in 2025, a significant portion of which came from a single bugSWAT live hacking event that accounted for $1.6 million.
• Chrome: Bounties for the browser remain high, with rewards reaching up to $250,000 for complex logic bugs and sandbox escapes.
• Mobile & Android: Maximum rewards for critical vulnerabilities in top-tier apps were increased to $300,000 to incentivize reports on high-impact bugs.