Google Offers $1 Million For Chrome Exploits

PatPending writes with news that Google will be offering up to $1 million for the discovery of new exploits in their Chrome browser. This comes as part of the CanSecWest security conference, and the rewards will be broken down into categories: $60,000 for an exploit using only Chrome bugs, $40,000 for an exploit using a Chrome bug in conjunction with other bugs, and $20,000 for exploits that affect Chrome (and other browsers) but are due to bugs in other software, like Flash, Windows, or drivers. Google had originally planned to offer rewards through the Pwn2Own competition, but they were concerned by the contest rules: "Unfortunately, we decided to withdraw our sponsorship when we discovered that contestants are permitted to enter Pwn2Own without having to reveal full exploits (or even all of the bugs used!) to vendors. Full exploits have been handed over in previous years, but it’s an explicit non-requirement in this year’s contest, and that’s worrisome. ... We guarantee to send non-Chrome bugs to the appropriate vendor immediately."

Comments

Re:What Google doesn't like, it replaces...

[ackthpt]

Bug finders now still get paid. but those who don't reveal everything Google wants do not.

True, and I don't think they are unreasonable to demand the full exploit when they are paying for it.

I don't necessarily always agree with Google's approach but I think it's good that they man up and pay for the bugs. I wish more companies would do that.

Microsoft would have been gone years ago. Never could fathom the approach they took tho, "Bug? What bug? There's a Bug?!? You must be a terrorist!" That really was all anyone needed to see to confirm how they operate.