Google now pays up to $450,000 for RCE bugs in some Android apps

Google expanded its Mobile Vulnerability Rewards Program for Tier 1 Android apps (e.g., Google Play Services, the Android Google Search app, Google Cloud, Gmail), raising top payouts to $300,000 for remote, no-interaction RCE and up to $450,000 for exceptional-quality reports that include mitigations and root cause analysis; data-theft exploits can earn up to $75,000. The update codifies quality expectations (clear descriptions, PoC, reproducible steps, impact) and adjusts reward tiers across attack vectors to incentivize high-impact, well-documented disclosures.