Other levels of compensation, without RCE, include demonstrating a controlled write or a memory corruption.
The baseline for bugs that do not demonstrate such “higher-quality reports” range from US$7,000 to US$25,000.
Last year, the total payouts in Google’s bug hunter program were US$10 million dollars, distributed among 632 people from 68 countries. Just over a third of the sum ($US3.4 million) concerned Android vulnerabilities. The second largest expenditure (US$2.1 million) concerned Chrome bugs.
