crosvm bug bounty programs
crosvm.dev Updated
Crosvm runs one public program: a Sorona bug bounty paying up to $16,000.
- Top reward
- $16,000
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 8
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program crosvm runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
crosvm
Sorona · Bug bounty |
– | $16k | $1,250 | – | $16,000 | Partial | – | – | Open |
-
- Critical
- –
- High
- $16k
- Medium
- $1,250
- Low
- –
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
8 targets. 8 excluded.
-
https://crosvm.dev
Web
-
The ChromeOS VRP takes any security issue affecting the ChromeOS ecosystem, and crosvm ships in every ChromeOS image as the VMM behind Crostini, ARCVM and Steam. One severity table applies with no per-asset rows, so a single Critical reaches $30,000
Products and areas
-
The control socket and command-line surface used to build and manage a VM, plus the vsock services Crostini and ARCVM expose across the guest boundary
Products and areas
-
The graphics path, covering virtio-gpu, the wayland proxy and the cross-domain route into the host compositor and renderer
Products and areas
-
The plumbing that stands a guest up: kernel and firmware loading, ACPI and device-tree construction, PCI and interrupt emulation, pvclock, and the vhost and vhost-user backends crosvm talks to
Products and areas
-
The sandbox crosvm builds around itself: the process-per-device split, the minijail wrapping and the seccomp policy files shipped for each device type
Products and areas
-
The virtio device models crosvm implements, from block, net and console through gpu, sound, video, input, balloon, vsock, virtiofs, 9p and pmem, wherever guest-controlled data reaches them
Products and areas
-
The VMM core: KVM setup, vCPU threads, guest memory mapping, and the MMIO, port-IO and ioevent dispatch that carries every guest exit into device code
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 8
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Crashes that fall short of a full denial of service: the rules exclude bugs that cause a crash unless restart is not possible
-
crosvm as it ships inside the Android Virtualization Framework rather than inside ChromeOS, since this program's scope statement is written around the ChromeOS ecosystem
-
Fuzzer crashes filed without showing that an attacker can reach and control the path
-
Graphics-virtualization renderer bugs where the attacker only reaches their own guest's data, since the program treats that process as inside the guest boundary
-
Issues that only manifest with the device in Developer mode, which the rules exclude outright
-
LTS-channel-only findings and hardware past its auto-update expiry, both outside the supported configuration the program pays on
-
Reports filed outside bughunters.google.com with a Google Account, which the rules treat as typically not reward-eligible, and researchers in Russia or Belarus, whom sanctions screening bars from payment
-
Unreachable code paths, and highly or substantially mitigated issues, which the rules state will not qualify for a reward
Recent changes
Reward and scope changes across every crosvm program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under crosvm.dev: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.