errors search

errors.x7.al › Recent issues

Google temporarily pauses OSS VRP product vulnerability submissions

Google's vulnerability-reward team (Google VRP) announced on 1 October 2026 that it is temporarily no longer accepting "product vulnerability" submissions to its Open Source Software Vulnerability Reward Program (OSS VRP). According to the announcement, the pause is due to a significant rise in automated submissions, the vast majority of which Google says are not valid.

Advertisement

What's happening

The change was posted by Google's vulnerability-reward account on 1 October 2026. The post states that Google is "temporarily no longer accepting OSS VRP product vulnerability submissions" and points readers to the OSS VRP rules. It explicitly says the pause does not impact OSS VRP supply chain reports, or any outstanding reports — so those categories continue as before.

Google describes the reason as a significant rise in automated submissions, "the vast majority of which are not valid." The team says it will continue to reformat this aspect of the OSS VRP and commits to giving an update in Q1 2027. This is a change to a reward program's intake rules, not a security incident, breach or outage; no software has been reported as newly vulnerable because of it.

It is worth being precise about the wording. The post uses "temporarily" and promises a future update, so it describes a pause rather than a permanent removal of the category. As with any announcement, the program's own rules page remains the authority and may change again.

Who's affected

  • Open-source bug hunters and security researchers who submit — or planned to submit — product vulnerabilities to Google's OSS VRP. Those submissions are reportedly not being accepted while the pause is in effect.
  • Supply chain reports and already-open reports are not affected, according to the announcement.
  • Other researchers and vendors are unaffected; this concerns Google's OSS VRP intake, not the security of any product in general.

Because the change is about eligibility and intake rather than a specific defect, it does not mean any product has become unsafe. It mainly affects where a given finding should be sent.

What to do

If you file security reports, the practical guidance follows Google's own suggestion in the post:

  • Send product findings elsewhere. Google encourages researchers to look for impact across its other vulnerability-reward programs and submit there instead, or to pursue the Patch Rewards Program.
  • Continue supply chain and outstanding reports as normal. The announcement says these are unaffected.
  • Watch for the Q1 2027 update. Google says it will work on this aspect of the OSS VRP and provide an update then; re-check the rules page before relying on any summary, including this one.
  • Keep to coordinated disclosure. Whatever the program, give vendors a reasonable window to fix issues before publishing details.

There is no workaround or software fix to apply — this is a program scope change, not a bug.

Sources

Advertisement