Google adds $250,000 Cloud VRP reward for Root-in-Cloud bugs
Original title: Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs
Researchers earn $250,000 for proving full administrative control over arbitrary Google Cloud organizations.
Google expanded its Cloud Vulnerability Reward Program with a $250,000 top-tier payout for Root-in-Cloud bugs. These include tenant-isolation bypasses and complex cross-service logic flaws that grant full IAM control without prior access. Reports must use a designated service account for deterministic proof and prohibit probing on production infrastructure.
- $250,000 reward for full roles/owner IAM control over arbitrary projects
- Exploits cannot rely on credentials or user interaction
- Must stop probing after root-in-prod execution
- Program suspended OSS VRP submissions in October due to AI reports
Impact: full administrative control over arbitrary Google Cloud organizations
| Product | Affected |
|---|---|
| Google Cloud | — |
- Vendors
- Products
- Google Cloud
From the original article
2 min read at bleepingcomputer.com
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.