What vulnerabilities do Google services have and how much in 2023 company paid specialists who discovered them?

In 2023, Google paid out $10 million through its global bug bounty program to researchers and white hat hackers for identifying vulnerabilities in its services and projects including Chrome, Android, Google Play, Google products, and the company's open-source software. This is $2 million less than in 2022.

Experts believe that although this amount is lower than Google's vulnerability rewards in 2022, it is still significant, demonstrating the company's high level of interest in engaging the cybersecurity community in Google's security efforts. For comparison, in 2023, Yandex paid researchers $770 thousand under its "Bug Hunt" bounty program.

The highest reward for vulnerability reports in Google services in 2023 was $113,337. Payments were received by 632 white hat hackers from 68 countries worldwide.

The total amount paid by Google since the launch of its bug bounty program in 2010 reached $59 million in rewards for security researchers from 84 different countries for reporting more than 15,000 vulnerabilities.

Google paid out over $3.4 million for vulnerabilities found in Android in 2023. Another major Google project, the Chrome browser, was also under scrutiny. White hat hackers submitted 359 security bug reports for which Google paid a total of $2.1 million in 2023. Other significant payouts by the company related to vulnerability reports in cloud AI products such as Google Cloud and the Google Gemini chatbot (Bard).

Additionally, in 2023, Google continued its Mobile VRP program to identify vulnerabilities in third-party Android apps. The company provided access to the online platform Bughunters blog where white hat hackers can exchange ideas and security measures on the internet. Apart from bug bounty programs, Google held several cybersecurity conferences in 2023, featuring various online and offline technical hacking events, meetings, seminars, and hackathons.

In addition, in the previous year, Google allocated over $200 thousand in security research grants and also accepted reports through the Android Chipset Security Reward Program (ACSRP), which is available by invitation only. This is a private Google reward program working in partnership with Android chipset developers.