Google has expanded its Cloud Vulnerability Reward Program (VRP) with a top bounty of $250,000 for high-impact architectural vulnerabilities that could let an attacker obtain full administrative control of a Google Cloud organization without prior access or special project setup.
$250,000 bounty for Root-in-Cloud vulnerabilities
Starting in November 2026, security researchers can qualify for the new top-tier reward by demonstrating a Root-in-Cloud vulnerability. Eligible flaws include tenant-isolation bypasses and complex service-to-service logic vulnerabilities that enable full administrative control over any Google Cloud organization.
“To earn this Premier benefit, you must demonstrate full administrative control (equivalent to ‘role/owner’) or full IAM control over any Google Cloud organization or project, without requiring prior access or special project setup,” said Chris Betts, Chief Information Security Officer at Google Cloud.
Valid reports demonstrating remote code execution (RCE) or root access in production on Google’s underlying infrastructure, known as Borg, will also be automatically reviewed by the Google Cloud VRP panel for Root-in-Cloud eligibility.
Strict rules for testing Google Cloud vulnerabilities
Researchers cannot rely on prior access to the victim project, compromised credentials, social engineering or user interaction to qualify for the reward.
Researchers who achieve code execution on Google’s production infrastructure must stop their investigation. Escalation, production credential capture and lateral movement are prohibited and will result in disqualification.
“High incentives require clear and secure rules of engagement. We never want researchers to test exploits against real customer projects,” said Michael Cote, Cloud VRP Lead.
“Instead, we created a deterministic root proof mechanism using a designated service account. Researchers can cryptographically prove unauthorized access to that identity.”
Google’s Google Cloud VRP rules provide endpoint specifications, JSON payloads and command-line examples for the technical validation process.
Google reports record vulnerability reward payments
The expansion follows Google’s suspension of submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) in October after a flood of AI-generated reports.
Google says it has rewarded thousands of security researchers worldwide with more than $81.6 million since launching its first Vulnerability Reward Program in 2010.
In 2025, the company awarded a record $17.1 million to more than 700 security researchers. That total was 40% higher than the $12 million awarded in 2024.
Source: www.bleepingcomputer.com