Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

google.github.io Updated Part of Google

Sorona.xyz runs two public programs: a Sorona bug bounty paying up to $250,000 and a Sorona bug bounty paying up to $101,000.

Top reward
$250,000
Sorona
Programs
2
2 pay cash
Targets in scope
16
2 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

kvmCTF (Linux KVM hypervisor)

Sorona · Pays the most of the 2 programs: up to $250,000.

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

16 targets across all 2 programs, each listed once with the programs that cover it. 12 excluded.

  • https://google.github.io/security-research/kernelctf/rules.html

    Web

    Covered by kernelCTF (Linux kernel LTS)

  • https://google.github.io/security-research/kvmctf/rules.html

    Web

    Covered by kvmCTF (Linux KVM hypervisor)

  • Any subsystem the Container-Optimized OS config compiles in and an unprivileged local user can reach: the syscall entry paths, the VFS and the filesystems built into that config, memory management, the scheduler, futexes and System V IPC, cgroups, eBPF, perf and tracing, the /proc and /sys interfaces, and the character and block devices exposed under /dev

    Products and areas

    Covered by kernelCTF (Linux kernel LTS)

  • arch/x86/kvm in full: the VMX and SVM entry paths, VM-exit handling, and the vCPU state machine behind them

    Products and areas

    Covered by kvmCTF (Linux KVM hypervisor)

  • Both 0-day and 1-day vulnerabilities: a bug already patched upstream still earns the base reward, it just does not carry the $20,000 0-day bonus

    Products and areas

    Covered by kernelCTF (Linux kernel LTS)

  • Hypercalls and the paravirtualised interfaces a guest can invoke directly, including asynchronous page faults, paravirtual EOI and steal-time accounting

    Products and areas

    Covered by kvmCTF (Linux KVM hypervisor)

  • Instruction emulation and the MMIO paths, where guest-controlled bytes are decoded and acted on by host kernel code

    Products and areas

    Covered by kvmCTF (Linux KVM hypervisor)

  • Local privilege escalation from an unprivileged user to root, demonstrated end to end by stealing the flag off the instance

    Products and areas

    Covered by kernelCTF (Linux kernel LTS)

  • MSR and CPUID handling, the emulated interrupt controllers (local APIC, IOAPIC and PIC), and the emulated timers

    Products and areas

    Covered by kvmCTF (Linux KVM hypervisor)

  • Nested virtualization: the host's handling of a guest hypervisor's control structures, VMCS and VMCB state included

    Products and areas

    Covered by kvmCTF (Linux KVM hypervisor)

  • Novel exploitation techniques against any available environment, judged quarterly at Google's discretion and paid separately from the exploit ladder

    Products and areas

    Covered by kernelCTF (Linux kernel LTS)

  • The contest declares one target: a live instance running the latest LTS Linux kernel with the Container-Optimized OS config. The code under test is the upstream GPL-2.0 kernel rather than a Google fork, and what pays is a working exploit that takes the flag off that instance

    Products and areas

    Covered by kernelCTF (Linux kernel LTS)

  • The memory side: EPT and NPT, shadow paging, memslot management, and the translation from a guest physical address into host memory

    Products and areas

    Covered by kvmCTF (Linux KVM hypervisor)

  • The networking stack as configured, covering the socket layer, protocol handling and netlink

    Products and areas

    Covered by kernelCTF (Linux kernel LTS)

  • The reliability of the exploit itself, which is scored rather than assumed: exploit_repro has to report 90% or better before the stability bonus applies

    Products and areas

    Covered by kernelCTF (Linux kernel LTS)

  • Upstream KVM in the Linux kernel as Google runs it: a stock v6.1.74 LTS host on an Intel Xeon Gold 5222, with the target available built with CONFIG_KASAN enabled or disabled. You are connected to a Debian 12.5 guest on a v6.1.0-21 kernel with the default Debian config, and the finding has to cross from that guest into the host. 0-day only, demonstrated live against the instance

    Products and areas

    Covered by kvmCTF (Linux KVM hypervisor)

No target matches. Try part of a host name, such as the company name.

Out of scope 12

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Already-patched 1-day bugs, since the program buys 0-days demonstrated live

    kvmCTF (Linux KVM hypervisor)

  • Anything short of a demonstrated, working exploit. A crash, a theoretical write primitive or a patch on its own does not qualify

    kernelCTF (Linux kernel LTS)

  • Anything shown only against a locally built kernel rather than against Google's pinned instance

    kvmCTF (Linux KVM hypervisor)

  • Anything that depends on unprivileged user namespaces, disabled on the instance since 1 July 2025 precisely because that surface was producing too many winning exploits

    kernelCTF (Linux kernel LTS)

  • CPU, DRAM and other hardware-based issues, the Spectre, MDS and Rowhammer families among them, which are not rewarded here

    kvmCTF (Linux KVM hypervisor)

  • Duplicates and late entries: "Only the first submission for a vulnerability is eligible for a reward (per target)", and there is one paid slot per LTS kernel version

    kernelCTF (Linux kernel LTS)

  • io_uring and nftables, both disabled on the target for the same reason

    kernelCTF (Linux kernel LTS)

  • Kernel subsystems outside KVM, which belong to kernelCTF or to the kernel's own security process rather than to this program

    kvmCTF (Linux KVM hypervisor)

  • Kernel versions other than the LTS the instance is currently running, which rotates every two to four weeks on average

    kernelCTF (Linux kernel LTS)

  • QEMU vulnerabilities, excluded explicitly despite QEMU being the userspace half of the same stack

    kvmCTF (Linux KVM hypervisor)

  • Submissions that require a separately supplied KASLR base, which the 2026-04-30 rules removed as an option

    kernelCTF (Linux kernel LTS)

  • The host-to-KVM direction, which is not the boundary this program prices

    kvmCTF (Linux KVM hypervisor)

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under google.github.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.