Google Cloud adds $250,000 Root-in-Cloud reward for takeover research

Google Cloud has added a $250,000 Root-in-Cloud reward to its vulnerability reward program. In an Oct. 29 announcement, Google Cloud CISO Chris Betz said qualifying research must demonstrate full administrative control over arbitrary Google Cloud organizations or projects, equivalent to “roles/owner” privileges or complete IAM control. The demonstration cannot depend on prior access or a special project setup.

Google's eligibility rules rule out exploit paths that rely on an existing foothold in the victim project, leaked, phished or stolen credentials, or user interaction or social engineering. Valid reports showing remote code execution in Borg, Google's underlying production infrastructure, or achieving root-in-prod will automatically go to a Google Cloud panel for a Root-in-Cloud eligibility review. That review is not an automatic $250,000 award: The panel will assess the entry point, execution context and attack surface to determine whether arbitrary tenant or project takeover is achievable, then award a bounty accordingly.