Android and Google Devices Security Reward Program
Google pays up to $1,500,000 for exploit chains against Pixel, Nest and Fitbit devices, and up to $25,000 for strong single bugs. Rolling, no deadline.
The Android and Google Devices Security Reward Program pays security researchers who find and report serious vulnerabilities in Android and in Google hardware. Google rebuilt the program around user impact in April 2026, and the rules page was last updated in October 2026.
The highest rewards go to full exploit chains. A Titan M2 compromise with persistence can earn up to $1,500,000, and without persistence up to $750,000. Data exfiltration from a Secure Element pays up to $375,000 and a software lockscreen bypass up to $150,000. These top figures include bonuses for exploit chains shown against specific developer preview versions of Android. Single bugs are paid on a flexible scale, and exceptional standalone reports can reach $25,000.
The scope covers Pixel phones, tablets and watches, Nest cameras, speakers, displays, thermostats and routers, and Fitbit trackers and smartwatches. Bugs must reproduce on the latest public build. On the software side it includes AOSP code, Android TV, WearOS, Android Automotive OS, GooglebookOS, OEM code and drivers on these devices, the TEE, Secure Elements, bootloaders and firmware. Devices that lose security updates within 90 days are out of scope.
Google says it now focuses on bug classes that are still hard for automated AI tools to find. Accepted impacts include code execution, pKVM boundary breaks, permission bypasses, tapjacking, cross user data access and remote denial of service that forces a factory reset. Reports on known non bugs or published threat models are closed without a reward.
Reports go through the Google Bug Hunters reporting form. The first complete report with a working proof of concept counts as the original. Reports filed early without a proof of concept only to get a timestamp can lose to a later, complete report. Google also tracks the signal to noise ratio of each researcher, and accounts that send unverified or AI generated findings may be rate limited.
Quick answers
Do I need a proof of concept?
Yes. A working proof of concept must come with the first report. For bugs that rely only on the user interface, a clear video with step by step instructions is accepted.
Do I have to suggest a fix?
For memory safety bugs a proposed patch or root cause fix is mandatory. For framework and logic bugs it is encouraged. Reports without a fix get a much lower reward.
Are upstream Linux kernel bugs covered?
Only if you show a working exploit with direct impact on Android or on modules maintained for Pixel. Backend services go to the main Google VRP instead.