Google boosts bonuses for Chrome bug bounty hunters

Google yesterday boosted payments to researchers for reporting bugs in Chrome, saying the move was prompted by a decline in vulnerabilities submitted by outsiders.

"Recently, we've seen a significant drop-off in externally reported Chromium security issues," Chris Evans, a Chrome software engineer, said in a Tuesday post to the Chromium Blog. "This signals to us that bugs are becoming harder to find."

Evans outlined new bonuses that Google will award researchers who report certain kinds of flaws. All the bonuses start at $1,000 but can climb from there.

Google will add the bonuses to the base payments -- which range from $500 to $3,133 -- for bugs that are "particularly exploitable," found in the more bug-free sections of Chrome's code, and for vulnerabilities that affect more than just the browser.

In the past, Google has written bonus checks for up to $10,000 for what it calls "particularly significant contributions." Those bonuses have been reserved for long-running reporting. Last March, for example, Google awarded three of its most prolific bug submitters $10,000 each.

The big-dollar bonuses remain in play, said Evans, and will also be awarded for especially impressive one-time reports that, for instance, detail graphics driver vulnerabilities, exploits in Chrome's 64-bit edition, or flaws in the "IJG libjpeg," the JPEG image encoding and decoding libraries.

Chrome and Mozilla's Firefox both rely on a newer variant of those libraries, dubbed "libjpeg-turbo," to accelerate image handling.

To mark the new bonus program, Google retroactively awarded $1,000 to one researcher and $3,000 to another.

Google debuted its bug bounty program in January 2010, raised the maximum payment from $1,337 to $3,133 in July of that year, and expanded the program in November 2010 to include security flaws on its websites.

So far this year, Google has paid researchers more than $250,000, nearly half of it to a pair who exploited Chrome at this year's Pwn2Own hacking contest.

Google last patched security vulnerabilities in Chrome on Aug. 8 and last paid bounties on July 31.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is gkeizer@computerworld.com.

See more by Gregg Keizer on Computerworld.com.

Read more about application security in Computerworld's Application Security Topic Center.

• Tweet