Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

android.com Updated Part of Google

Sorona.xyz runs two public programs: a Sorona bug bounty paying up to $25,000 and a Sorona bug bounty paying up to $25,000.

Top reward
$25,000
Sorona
Programs
2
2 pay cash
Targets in scope
19
2 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Android Runtime (ART) and libcore

Sorona · Pays the most of the 2 programs: up to $25,000.

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

19 targets across all 2 programs, each listed once with the programs that cover it. 14 excluded.

  • https://source.android.com

    Web

    Covered by Android Runtime (ART) and libcore

  • https://source.android.com/docs/core/virtualization

    Web

    Covered by Android Virtualization Framework and pKVM

  • AOSP code as it ships across Android TV, WearOS and Android Automotive OS, which the same platform-and-software scope covers

    Products and areas

    Covered by Android Virtualization Framework and pKVM

  • ART in full: the interpreter, the optimizing compiler, dex2oat ahead-of-time compilation, the JIT and the garbage collector

    Products and areas

    Covered by Android Runtime (ART) and libcore

  • Code execution in hypervisors generally, which the program's arbitrary-code-execution category lists beside the TEE and Secure Elements

    Products and areas

    Covered by Android Virtualization Framework and pKVM

  • DEX and CompactDex file parsing and verification, including the bytecode verifier that decides whether attacker-supplied code is allowed to run at all

    Products and areas

    Covered by Android Runtime (ART) and libcore

  • libcore, Android's java.* standard library implementation, serialization included

    Products and areas

    Covered by Android Runtime (ART) and libcore

  • Microdroid, the minimal guest OS AVF boots inside a protected VM, together with its payload loading and its own userspace

    Products and areas

    Covered by Android Virtualization Framework and pKVM

  • Parcel and Parcelable serialization across the Android Framework. The rules name Parcel Mismatch as a qualifying gadget-chain class and name arbitrary code execution across privileged, unprivileged and constrained contexts as a qualifying impact

    Products and areas

    Covered by Android Runtime (ART) and libcore

  • The app sandbox boundary as the runtime enforces it, which is what separates one installed application from another

    Products and areas

    Covered by Android Runtime (ART) and libcore

  • The AVF crosvm build, the virtual machine monitor that constructs the guest and mediates its virtio device access

    Products and areas

    Covered by Android Virtualization Framework and pKVM

  • The JNI boundary and the Java-to-native transition, where managed guarantees stop applying and raw memory begins

    Products and areas

    Covered by Android Runtime (ART) and libcore

  • The pKVM hypervisor in the Android common kernel: the EL2 code, the host-to-hypervisor call interface, stage-2 translation, and the memory donation and sharing rules that hold host, hypervisor and protected VM apart

    Products and areas

    Covered by Android Virtualization Framework and pKVM

  • The program's platform and software scope covers the device software stack "including but not limited to" Android Open Source Project code, which it names first. ART and libcore are AOSP code, and a single runtime bug is priced on the standalone row

    Products and areas

    Covered by Android Runtime (ART) and libcore

  • The protected VM boot path in packages/modules/Virtualization: pvmfw, the instance disk, and the measurement and attestation chain that establishes what is running inside a pVM

    Products and areas

    Covered by Android Virtualization Framework and pKVM

  • The rest of the AOSP device software stack sits under the same declaration. This page covers the ART and libcore trees inside it

    Products and areas

    Covered by Android Runtime (ART) and libcore

  • The same platform and software scope as the AOSP entry, covering the whole device software stack with Android Open Source Project code named first, and pKVM boundary defeats called out separately as a qualifying impact in both directions

    Products and areas

    Covered by Android Virtualization Framework and pKVM

  • The trap and emulation paths a guest reaches the hypervisor through, covering guest exits, MMIO handling and interrupt injection

    Products and areas

    Covered by Android Virtualization Framework and pKVM

  • virtualizationservice and virtmgr, the AVF userspace daemons that create, configure and supervise protected VMs for apps and system services, and the AIDL surface those callers arrive on

    Products and areas

    Covered by Android Virtualization Framework and pKVM

No target matches. Try part of a host name, such as the company name.

Out of scope 14

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Anything on the published Android threat-model non-bug list, closed as unactionable and ineligible for a reward

    Android Virtualization Framework and pKVM

  • Anything you cannot reproduce on an in-support Google device, so a result that only holds on an emulator or an out-of-support handset does not qualify

    Android Virtualization Framework and pKVM

  • Backend and server-side services, which route to the main Google VRP rather than to this program

    Android Virtualization Framework and pKVM

  • Devices within 90 days of the end of their guaranteed security updates

    Android Runtime (ART) and libcore

  • Generic upstream Linux kernel bugs without an Android-specific proof of concept, even where the code path is shared

    Android Virtualization Framework and pKVM

  • Google backend services and server-side APIs, which belong to the separate Google and Alphabet VRP rather than to this program

    Android Runtime (ART) and libcore

  • Individuals and entities in Russia or Belarus, who cannot be paid, along with anyone else the sanctions rules reach

    Android Runtime (ART) and libcore

  • Issues already covered by Android's published threat models and known-non-bug list

    Android Runtime (ART) and libcore

  • Non-Pixel OEM devices, which do not satisfy the hardware-reproduction requirement even when the underlying code is identical. The proof of concept has to run on the latest public build of supported Pixel, Nest or Fitbit hardware

    Android Runtime (ART) and libcore

  • Payment to individuals in Russia or Belarus, which the program's sanctions screening blocks

    Android Virtualization Framework and pKVM

  • Reports that rely on highly improbable preconditions or unrealistic user interaction, and findings below the program's impact thresholds

    Android Virtualization Framework and pKVM

  • Shell reports filed without a proof of concept to reserve a timestamp, which the program treats as noise against your account rating

    Android Virtualization Framework and pKVM

  • Submissions from Google employees and from employees of Google partner companies developing code for covered devices

    Android Virtualization Framework and pKVM

  • Upstream Linux kernel and generic Linux components, "unless the reporter provides a functional Proof of Concept demonstrating a direct, exploitable impact specifically on Android or Pixel-maintained modules"

    Android Runtime (ART) and libcore

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in sorona.xyz products, from the NVD.

Search NVD
  • CVE-2020-8913 High

    A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's dat

  • CVE-2020-8913 High

    A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's dat

  • CVE-2011-4700 Medium

    The UberMedia UberSocial (com.twidroid) application 7.x before 7.2.4 for Android does not properly protect data, which allows remote attackers to read or modify Twitter information via a crafted application.

  • CVE-2011-4702 Medium

    The Nimbuzz (com.nimbuzz) application 2.0.8 and 2.0.10 for Android does not properly protect data, which allows remote attackers to read or modify a contact list via a crafted application.

  • CVE-2011-4697 Medium

    The Xiaomi MiTalk Messenger (com.xiaomi.channel) application before 2.1.320 for Android does not properly protect data, which allows remote attackers to read or modify messaging information via a crafted application.

  • CVE-2011-4698 Medium

    The AndroidAppTools Easy Filter (com.phoneblocker.android) application 1.1 and 1.2 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and call records via a crafted application.

  • CVE-2011-4699 Medium

    The Ubermedia Twidroyd Legacy (com.twidroydlegacy) application 4.3.11 for Android does not properly protect data, which allows remote attackers to read or modify Twitter information via a crafted application.

  • CVE-2011-4701 Medium

    The CallConfirm (jp.gr.java_conf.ofnhwx.callconfirm) application 2.0.0 for Android does not properly protect data, which allows remote attackers to read or modify allow/block lists via a crafted application.

About this page

This page gathers every public program listed under android.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.