<story><title>Increasing Google and Alphabet VRP rewards</title><url>https://bughunters.google.com/blog/5400513950908416/increasing-google-alphabet-vrp-rewards-up-to-151-515</url></story><parent_chain></parent_chain><comment><author>Topfi</author><text>I am genuinely surprised that these have been and continue to be so low. Do not know why but I was under the impression, that we had already gotten into the 1 Million USD range. While I do not know how much an interested party would realistically pay for an exploit that enables the complete takeover or even just limited access to a Gmail&amp;#x2F;Google account, I am pretty sure it has to be an order (perhaps even orders) of magnitude more than 75k.&lt;p&gt;Looked into it and am equally surprised to find that others, like Microsoft [0] also have such low bounties for these types of attacks.&lt;p&gt;While providing such an exploit to the affected company has value beyond the bounty (potential job offers, media exposure, credibility, ethical considerations, etc.), weighing that up against life-changing money really makes it hard to fault those who take the more lucrative route of selling these to the highest bidder, whoever that may be.&lt;p&gt;Seriously, Alphabet and Co. can afford more, especially considering any such exploit would most certainly hit their bottom line&amp;#x2F;stock far beyond a few 100k.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;msrc&amp;#x2F;bounty&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;msrc&amp;#x2F;bounty&lt;/a&gt;</text></comment>
<story><title>Increasing Google and Alphabet VRP rewards</title><url>https://bughunters.google.com/blog/5400513950908416/increasing-google-alphabet-vrp-rewards-up-to-151-515</url></story><parent_chain></parent_chain><comment><author>neilv</author><text>So if you find several catastrophic vulnerabilities each year, then you can make as much as one of the many people whose jobs it was &lt;i&gt;not&lt;/i&gt; to create those vulnerabilities in the first place? :)</text></comment>