● Covered by 3 sources · 3 reportsMedium impact3 neutral
Google Cloud VRP Introduces New $250,000 Root-in-Cloud Reward Tier
Key points
- Google Cloud VRP added a $250,000 Root-in-Cloud reward tier.
- Targets high-impact architectural research and tenant-isolation bypasses.
- Requires full administrative control over Google Cloud organizations/projects.
- Exploits must not rely on pre-existing access or user interaction.
- Exploits demonstrating RCE in Borg or root-in-production are eligible.
- Researchers must halt probing immediately upon achieving execution in Borg.
- Escalation, credential extraction, and lateral movement in Borg are not allowed.
- Chris Betz, Google Cloud's CISO, announced the new reward tier.
- The reward requires demonstrating 'roles/owner' or complete IAM control.
New Reward Tier for Cloud Vulnerabilities
Google Cloud's Vulnerability Reward Program (VRP) has introduced a new top reward tier, offering $250,000 for "Root-in-Cloud" vulnerabilities. This expansion aims to incentivize security researchers to discover critical software vulnerabilities that require advanced human analysis.
Focus on Architectural Research
The new tier specifically targets high-impact architectural research, including tenant-isolation bypasses and complex cross-service logic flaws. Google Cloud states that these types of vulnerabilities require human creativity, intuition, and rigorous systems analysis, which go beyond automated discovery methods.
Eligibility Criteria
To qualify for the $250,000 reward, researchers must demonstrate full administrative control, equivalent to "roles/owner" or complete IAM control, over arbitrary Google Cloud organizations or projects. This must be achieved without any prior access or special project setup. The exploit path cannot depend on pre-existing access, leaked credentials, user interaction, or social engineering.
Validation and Infrastructure Exploits
Google Cloud has defined technical criteria for validating root-in-cloud access to ensure safe, clear, and reproducible testing without impacting production environments. Additionally, valid vulnerability reports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will be evaluated for root-in-cloud eligibility. Researchers are instructed to halt probing immediately upon achieving any execution in Borg due to potential impacts on service availability or cross-tenant data.
Updates
- Chris Betz, Google Cloud's CISO, announced the new reward tier.
- The reward requires demonstrating 'roles/owner' or complete IAM control.
- Exploits demonstrating RCE in Borg or root-in-production are eligible.
- Researchers must halt probing immediately upon achieving execution in Borg.
- Escalation, credential extraction, and lateral movement in Borg are not allowed.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2026-1096189.8 CRITICAL CVE CVE-2026-109618.3 HIGH CVE CVE-2026-1096198.1 HIGHHow outlets covered it
Google has introduced a new top-tier reward of $250,000 within its Cloud Vulnerability Reward Program (VRP) for Root-in-Cloud bugs. This reward targets architectural security flaws that allow full administrative control over Google Cloud organizations without prior access or compromised credentials.
Google has expanded its Cloud Vulnerability Reward Program (VRP) by introducing a new top reward of $250,000 for security flaws that grant full administrative control over Google Cloud organizations or projects. This initiative aims to incentivize research into high-impact architectural weaknesses, particularly those demonstrating tenant-isolation bypasses or remote code execution in Google's Borg infrastructure.
Google Cloud's Vulnerability Reward Program (VRP) added a new $250,000 "Root-in-Cloud" reward tier for discovering high-impact architectural vulnerabilities. This tier targets human-led research into tenant-isolation bypasses and complex cross-service logic flaws, requiring full administrative control over Google Cloud organizations or projects without prior access.