Android and Play security reward programs help us work with top researchers from around the world to improve Android ecosystem security every day. To date, the ASR program has rewarded researchers with over $3M, paying out roughly $1M per year. There were no payouts for our highest possible reward: a complete remote exploit chain leading to TrustZone or Verified Boot compromise. Google Play Security Reward Program has reported over 30 vulnerabilities through the program, earning a combined bounty amount of over $100K.”]
Source: https://security.googleblog.com/2018/09/android-and-google-play-security_20.html