Google is offering a $250,000 reward for discovering a serious security vulnerability in Chrome—the highest amount in its own bounty program. As reported by "Golem," the vulnerability affects CVE-2025-4609, which was fixed in Chrome version 136 on May 14th. The company categorizes it as "High," and in the Tenable database, it has a CVSS score of 9.8, effectively equivalent to "Critical."
According to the announcement, the vulnerability exists in Google's inter-process communication (IPC) library, Mojo. Under certain circumstances, an incorrect "handle" (a resource access indicator) is allocated—a sandbox bypass. The discoverer, a security researcher named Micky, published a detailed report that included a working exploit. As proof, he launched the Calculator app on the target system. Indicators indicated that the bug was limited to Windows.
Because this was a high-risk sandbox escape and the report containing the vulnerability was of very high quality, Google paid the maximum expected premium. Users should ensure they have Chrome version 136 or higher installed to protect against this vulnerability.
