[ad_1]
Google is getting a little more serious about the security of its Chrome apps.
The Web giant this week expanded its vulnerability reward program to include all Chrome apps and extensions developed and branded as “by Google.” Rewards for each bug will range from the usual $500 up to a cool $10,000, depending on the permissions and data the extension handles.
“We think developing Chrome extensions securely is relatively easy (given our security guidelines(Opens in a new window) are followed), but given that extensions like Hangouts and Gmail are widely used, we want to make sure efforts to keep them secure are rewarded accordingly,” Google security team members Eduardo Vela Nava and Michal Zalewski wrote in a blog post(Opens in a new window).
Meanwhile, Google also increased the reward amounts offered as part of its open-source Patch Reward Program. Launched in October, the experimental program offers cash rewards for “proactive security improvements” to select open-source projects.
Under the new reward structure, you can receive $10,000 for “complicated, high-impact improvements that almost certainly prevent major vulnerabilities in the affected code.” Meanwhile “moderately complex patches that provide convincing security benefits” can now earn you $5,000 each while simpler submissions that “offer only fairly speculative gains” now net between $500 and $1,337.
If you find a vulnerability in a Google-developed Chrome extension, or another Google product, head over to the company’s submission form(Opens in a new window) to report it.
Also on the security front, Google announced that it will be warning(Opens in a new window) Chrome users if it appears that their browser settings have been hijacked. Chrome will alert Windows users whose settings appear to have been changed, and offer them the option to return to default settings.
The move comes after Google back in October added a “reset browser settings” button to Chrome’s settings page. Despite this, settings hijacking is the No. 1 complaint among Google users, and the company said the problem is “continuing to grow at an alarming rate.”
[ad_2]
Source link : https://www.pcmag.com/news/google-expands-bug-bounty-program-offers-more-cash