AI-generated Fake Vulnerability Reports Flood; Google Adjusts Android and Chrome Vulnerability Reward Rules

In recent years, many users have used AI scanning to generate fake vulnerability reports for bounties, leading projects like Node.js and cURL to suspend security bounty programs. These reports are mostly invalid and seriously disrupt developers' work.

Google recently adjusted the rules for its Android and Chrome Vulnerability Reward Programs (VRP): it retains high-value rewards like zero-click exploit chains and full browser process attack chains, but lowers some bonuses and cancels extra reward mechanisms. The highest Android bounty remains $1.5 million (for zero-click and persistent vulnerabilities), and Chrome's full attack chain can get up to $250,000.

Google says AI tools have improved vulnerability discovery efficiency, so the program will prioritize high-risk vulnerabilities not easily found by AI. For Linux kernel vulnerabilities, it focuses on Google-maintained components; non-Google parts need proof of exploitation on Android devices. Though individual bounties may drop, overall 2026 spending is expected to grow.