coreboot bug bounty programs
coreboot.org Updated
Coreboot runs one public program: a Sorona bug bounty paying up to $30,000.
- Top reward
- $30,000
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 9
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program coreboot runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
coreboot
Sorona · Bug bounty |
$30k | $15k | $1,000 | – | $30,000 | Partial | – | – | Open |
-
- Critical
- $30k
- High
- $15k
- Medium
- $1,000
- Low
- –
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
9 targets. 6 excluded.
-
https://www.coreboot.org
Web
-
CBFS parsing, FMAP handling and the firmware-update path that writes new images
Products and areas
-
coreboot as Chromebooks ship it, across the whole boot flow: bootblock, romstage, ramstage, postcar and the payload handoff
Products and areas
-
depthcharge and the rest of the ChromeOS firmware payload chain up to the kernel
Products and areas
-
Google's declaration is a stack rather than a repository list: "Vulnerabilities discovered in the entire ChromeOS stack, including but not limited to supported hardware, firmware, OS components (Google and non-Google developed), are considered eligible for reward if they put ChromeOS device users at risk." coreboot is the non-Google firmware in that stack, so it is covered by category, and the report has to land on a supported Chromebook or ChromeOS Flex device
Products and areas
-
Platform init for shipping Chromebook mainboards, covering Intel and AMD SoC init and the Arm ports
Products and areas
-
SMM handlers and the SMI interface on x86 Chromebooks, which stay resident and privileged for the life of the running system
Products and areas
-
The coreboot-side interfaces to the embedded controller and the security chip, where early boot code acts on what another component reports
Products and areas
-
vboot, the verified-boot implementation, together with the write-protect and rollback-counter enforcement that anchors it
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Anything requiring open-chassis physical modification, such as defeating the write-protect screw or reflashing the SPI part directly
-
Bugs already disclosed publicly or handed to a third party for purposes other than fixing them
-
Developer-mode-only findings, LTS-channel-only findings, and anything the platform already mitigates
-
Devices outside the supported set: hardware no longer supported, or a device not running the latest ChromeOS in Stable, Beta or Developer in verified mode
-
Non-Chromebook coreboot ports, which are by far the largest part of the tree and put no ChromeOS device user at risk
-
The $500,000 standing award and the $100,000 chain award, both of which require a full exploit chain defeating Google-signed verified boot. A coreboot component bug is priced on the ordinary severity ladder and caps at $30,000
Recent changes
Reward and scope changes across every coreboot program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in coreboot products, from the NVD.
-
CVE-2022-29264 Critical
An issue was discovered in coreboot 4.13 through 4.16. On APs, arbitrary code execution in SMM may occur.
About this page
This page gathers every public program listed under coreboot.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.