Google Extends Security Bug Bounty to Gmail, YouTube, Blogger
Summary: Google expanded its security bug bounty program on Monday to cover Web properties including Gmail, YouTube and Blogger, after launching a Chrome-only program earlier in the year; desktop apps such as Android, Picasa and Google Desktop were excluded. The standard reward remains public recognition plus $500, with particularly severe or clever bugs earning up to $3,133.7, and Google said it would not pay for social engineering, physical attacks, black hat SEO, denial-of-service bugs, or flaws in recently acquired technologies.
What's compelling: The payout tops out at $3,133.7, while the article notes critical bugs in important online applications can fetch far higher prices in less reputable places online - so the program's reach depends on researchers who might otherwise post findings publicly, alerting the criminal community at the same time as Google.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026