Chromium bug bounty programs
chromium.org Updated Part of Google
Chromium runs one public program: a Sorona bug bounty paying up to $250,000.
- Top reward
- $250,000
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 10
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Chromium runs.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
Chromium
Sorona · Bug bounty |
$250,000 | Partial | – | – | Open |
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
10 targets. 7 excluded.
-
https://www.chromium.org
Web
-
Chrome's built-in AI features, which the reward table carries on separate rows for rogue actions and for sensitive data exfiltration
Products and areas
-
Google's declaration is one sentence: any High or Critical severity bug in Chrome Browser may be considered, qualified only by the requirement that it reach the Stable, Beta or Dev channel
Products and areas
-
GPU driver bugs reachable from the renderer, which the rules describe as user-mode GPU driver bugs in Mesa or Mali drivers
Products and areas
-
Site Isolation and the renderer sandbox across Windows, macOS, Linux, Android, ChromeOS and Fuchsia
Products and areas
-
The Blink rendering engine and the web platform it implements: DOM, CSS, layout, the HTML parser and the APIs a page can call
Products and areas
-
The browser process, the network service, the GPU process, the utility processes, and the Mojo IPC layer that connects them
Products and areas
-
The extensions system, WebUI, the Omnibox, and the permissions and security UI surface, with URL spoofing and web-platform privilege escalation priced on their own rows
Products and areas
-
Third-party components shipped with Chrome, which the rules name explicitly, giving PDFium and Skia as the examples
Products and areas
-
V8, covering the JavaScript and WebAssembly engines and the V8 sandbox, which the reward table prices on rows of its own
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 7
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Anything below the High or Critical bar the scope sentence sets, along with low-quality submissions, which are capped at the $500 base amount regardless of the class of bug described
-
Code on trunk less than seven days old, which has not reached any shipping channel
-
Experimental features, debugging features and unsafe flags, none of which represent a configuration users are exposed to
-
MiraclePtr-protected use-after-free in non-renderer processes, which the program now records as PROTECTED under BRP-ASAN rather than as a security bug
-
Server-side Google services, which route to the main Google VRP rather than to the Chrome program
-
Speculative reports that do not demonstrate the bug actually manifesting in Chrome
-
The full-chain rung is capped by budget as well as by difficulty: only four exploit bonuses will be paid in 2026, so a fifth complete chain has no band left to land on
Recent changes
Reward and scope changes across every Chromium program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Chromium products, from the NVD.
-
CVE-2023-1531 High
Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
-
CVE-2017-7000 High
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
-
CVE-2015-1346 High
Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
-
CVE-2015-1205 High
Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
-
CVE-2014-7942 High
The Fonts implementation in Google Chrome before 40.0.2214.91 does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
-
CVE-2014-7943 Medium
Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
-
CVE-2014-7941 Medium
The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner.cc in the UI implementation in Google Chrome before 40.0.2214.91 uses an incorrect data type for a certain length value, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted X11 data.
-
CVE-2014-7939 Medium
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.
About this page
This page gathers every public program listed under chromium.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.