Google Increases Android Bounty to $1.5 M for Zero‑Click Pixel Titan M2 Exploits, Adjusts Chrome Rewards
What Happened — Google announced a major overhaul of its Android and Chrome vulnerability‑reward programs. The top tier now pays up to $1.5 million for full‑chain, zero‑click exploits against the Pixel Titan M2 security chip with persistence (or $750 k without persistence). Chrome rewards for full‑chain browser‑process exploits have been capped at $250 k plus a $250,128 bonus for MiraclePtr‑protected memory attacks.
Why It Matters for TPRM —
- Higher payouts incentivize researchers to discover the most sophisticated, hard‑to‑detect flaws that could affect downstream vendors and customers.
- Shifts toward AI‑generated reports and narrowed focus on Linux‑kernel components may reduce the breadth of disclosed issues, potentially leaving certain attack surfaces under‑examined.
- Changes signal Google’s strategic emphasis on “high‑impact” bugs, which could affect risk assessments for any third‑party relying on Android or Chrome as a platform.
Who Is Affected — Mobile‑device manufacturers, OEMs, enterprise mobility managers, app developers, and any organization that integrates Android or Chrome into its product stack.
Recommended Actions —
- Review contracts and security clauses with Google‑related services (Android OEM agreements, Chrome Enterprise licensing).
- Verify that your own vulnerability‑management processes cover the newly‑highlighted attack scenarios (zero‑click, persistence, MiraclePtr).
- Update threat‑modeling to include potential exploitation of the Pixel Titan M2 chip and Chrome’s memory‑allocation protections.
Technical Notes — The bounty focuses on zero‑click, full‑chain exploits that achieve persistence on the Pixel Titan M2 security chip, a custom ARM‑based secure enclave. Chrome rewards target full‑chain exploits that bypass both renderer and OS sandboxes, with a special bonus for defeating MiraclePtr memory hardening. No specific CVE numbers were disclosed; the program encourages proof‑of‑concept submissions only. Source: BleepingComputer