Malwarebytes bug bounty programs
malwarebytes.com Updated
Malwarebytes runs two public programs: a self-hosted bug bounty and a HackerOne bug bounty paying up to $6,000 (paused).
- Top reward
- Not published
- Programs
- 2
- 2 pay cash
- Targets in scope
- 25
- 6 types, deduplicated
- Last change
- 12 Oct 2026
- 1 month ago
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Malwarebytes
Self-hosted
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Malwarebytes
Self-hosted · Bug bounty |
– | – | – | – | Not published | None | – | – | Open |
|
Malwarebytes
HackerOne · Bug bounty |
$6,000 (highest) | $2,500 (highest) | $750 (highest) | $100 (highest) | $6,000 | – | – | 7 hours average | Paused |
-
- Safe harbor
- None
-
- Critical
- $6,000 (highest)
- High
- $2,500 (highest)
- Medium
- $750 (highest)
- Low
- $100 (highest)
- First response
- 7 hours average
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
25 targets across all 2 programs, each listed once with the programs that cover it. 6 excluded.
-
BrowserGuard (Firefox/Chrome/Safari browser extension)
Products and areas No bounty
Covered by HackerOne
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
estore.malwarebytes.com
HackerOne
-
malwarebytes.zoom.us
HackerOne
-
pages.malwarebytes.com
HackerOne
-
store.malwarebytes.com
HackerOne
-
view.malwarebytes.com
HackerOne
-
Malwarebytes Anti-Ransomware
HackerOne
Recent changes
Reward and scope changes across every Malwarebytes program, newest first.
-
Paused HackerOne
Paused. Not accepting reports right now.
Recent CVEs
Published vulnerabilities in Malwarebytes products, from the NVD.
-
CVE-2022-50971 High
Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privileges by injecting malicious code into the system root path. Attackers can place executable files in unquoted path directories that execute with LocalSystem privileges during service startup or system reboot.
-
CVE-2022-50971 High
Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privileges by injecting malicious code into the system root path. Attackers can place executable files in unquoted path directories that execute with LocalSystem privileges during service startup or system reboot.
-
CVE-2023-29144 Low
Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection.
-
CVE-2023-29144 Low
Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection.
-
CVE-2024-6260 High
Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Antimalware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Malwarebytes service. By cre
-
CVE-2024-6260 High
Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Antimalware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Malwarebytes service. By cre
-
CVE-2024-25089 Critical
Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes.
-
CVE-2024-25089 Critical
Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes.
About this page
This page gathers every public program listed under malwarebytes.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.