Mozilla bug bounty programs
mozilla.org Updated
Mozilla runs 5 public programs on Sorona, its own site and HackerOne; 5 pay cash, the most up to $20,000 (Firefox / Gecko). 2 companies it owns, including 0din.ai and Firefox, run 3 more programs.
- Top reward
- $20,000
- Sorona
- Programs
- 8
- 8 pay cash
- Targets in scope
- 119
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
5 programs Mozilla runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Mozilla Bug Bounty
Self-hosted · The company-wide program. Pays up to $20,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Firefox / Gecko
Sorona · Bug bounty |
– | $11k (highest) | $3,125 (highest) | – | $20,000 | Partial | – | – | Open |
|
SpiderMonkey
Sorona · Bug bounty |
– | $10k | – | – | $20,000 | Partial | – | – | Open |
|
NSS
Sorona · Bug bounty |
– | $11k | $3,125 | – | $20,000 | Partial | – | – | Open |
|
Mozilla Bug Bounty
Self-hosted · Bug bounty |
– | – | – | – | $20,000 | Full | – | – | Open |
|
Mozilla
HackerOne · Bug bounty |
$15k (highest) | $6,000 | – | – | $15,000 | – | – | 1 hour average | Paused |
-
- Critical
- –
- High
- $11k (highest)
- Medium
- $3,125 (highest)
- Low
- –
- Safe harbor
- Partial
-
- Critical
- –
- High
- $10k
- Medium
- –
- Low
- –
- Safe harbor
- Partial
-
- Critical
- –
- High
- $11k
- Medium
- $3,125
- Low
- –
- Safe harbor
- Partial
-
- Safe harbor
- Full
-
- Critical
- $15k (highest)
- High
- $6,000
- Medium
- –
- Low
- –
- First response
- 1 hour average
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Mozilla owns
2 companies with 3 programs of their own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
119 targets across all 8 programs, each listed once with the programs that cover it. 23 excluded.
-
Any security bug in the main development or released versions of Firefox, Firefox for Android and Firefox for iOS as Mozilla Corporation ships them. The program names Nightly mozilla-central and Beta builds alongside the final releases, and the mobile applications count as targets in their own right.
Products and areas
Covered by Firefox / Gecko
-
api.accounts.firefox.com, the auth server API, covering session and key-fetch tokens, the key wrapping that protects synced data, device and session records, recovery keys and account deletion
Products and areas
Covered by Mozilla Accounts
-
ASN.1 and DER decoding, X.509 parsing, and certificate path building and validation through mozilla::pkix
Products and areas
Covered by NSS
-
Commonly adopted GenAI models and applications including but not limited to those from OpenAI, Meta, Google, Anthropic, SalesForce, etc.
Products and areas
Covered by Mozilla
-
Gecko itself: layout, the DOM, CSS, the HTML and XML parsers, SVG and the image decoders
Products and areas
Covered by Firefox / Gecko
-
Graphics and media: WebRender, the GPU process, playback and the bundled codecs
Products and areas
Covered by Firefox / Gecko
-
irregexp, the regular-expression engine, which shares its lineage with V8
Products and areas
Covered by SpiderMonkey
-
Mozilla pays for security bugs in its own code in the Firefox versions it ships, Nightly mozilla-central included, and NSS is vendored into that tree at security/nss
Products and areas
Covered by NSS
-
Mozilla's HackerOne program lists accounts.firefox.com as a bounty-eligible asset with a maximum severity of critical. Its scope instruction names six further domains underneath it and closes with the line "Source Code: https://github.com/mozilla/fxa"
Products and areas
Covered by Mozilla Accounts
-
oauth.accounts.firefox.com, the OAuth 2.0 and OpenID Connect surface: authorization and token endpoints, redirect handling, scopes, refresh tokens and relying-party registration
Products and areas
Covered by Mozilla Accounts
-
PKCS#11 module loading, and the PKCS#7/CMS and PKCS#12 handling around signed and encrypted blobs
Products and areas
Covered by NSS
-
profile.accounts.firefox.com and graphql.accounts.firefox.com, the profile and aggregated data layer where account data crosses a boundary
Products and areas
Covered by Mozilla Accounts
-
SpiderMonkey, the JavaScript and WebAssembly engine, in-tree at js/src and covered by this same table
Products and areas
Covered by Firefox / Gecko
-
subscriptions.firefox.com, the FxA-backed subscription platform and the billing authorisation behind it
Products and areas
Covered by Mozilla Accounts
-
The Baseline JIT and the IonMonkey and WarpMonkey optimising compilers, together with the inline-cache and object-shape machinery they specialise against
Products and areas
Covered by SpiderMonkey
-
The browser front end: the address bar and security indicators, permission and install prompts, downloads, the password manager, and profile and update handling
Products and areas
Covered by Firefox / Gecko
-
The built-in library surface: TypedArrays and ArrayBuffer, Atomics and SharedArrayBuffer, Proxy and Reflect, JSON, Date and Intl
Products and areas
Covered by SpiderMonkey
-
The certificate and key databases, cert9.db and key4.db, and the Mozilla root store as NSS consumes it
Products and areas
Covered by NSS
-
The content server at accounts.firefox.com: registration, login, password reset, account recovery, email verification and two-factor enrolment
Products and areas
Covered by Mozilla Accounts
-
The content-process sandbox and the parent/child IPC boundary, IPDL
Products and areas
Covered by Firefox / Gecko
-
The declaration Firefox runs on covers this code as well: any security bug in the main development or released versions Mozilla ships, Nightly mozilla-central included. SpiderMonkey is in-tree at js/src and inherits the client table rather than running a program of its own.
Products and areas
Covered by SpiderMonkey
-
The freebl and softoken primitives: RSA, the elliptic curves, the hash functions, the AEAD modes and the random number generator
Products and areas
Covered by NSS
-
The garbage collector, the nursery and tenured heap boundary, and weak-reference and finalisation handling
Products and areas
Covered by SpiderMonkey
-
The networking stack under netwerk/: URL parsing, HTTP handling, caching, cookies and origin attribution, together with NSS for TLS and certificate validation
Products and areas
Covered by Firefox / Gecko
-
The parser, the bytecode emitter and the Baseline interpreter
Products and areas
Covered by SpiderMonkey
-
The shared packages in the mozilla/fxa monorepo those services are built from, which is the code Mozilla's own scope instruction points a researcher at
Products and areas
Covered by Mozilla Accounts
-
The shared utility layer: SECItem memory handling, the base64 and PEM decoders, and the arena allocators the rest of the library sits on
Products and areas
Covered by NSS
-
The structured-clone path and the JSAPI surface Firefox embeds the engine through
Products and areas
Covered by SpiderMonkey
-
The TLS 1.2 and 1.3 handshake state machines, the record layer, extension handling, session resumption and early data, all driven by bytes from whichever peer is on the other end
Products and areas
Covered by NSS
-
Third-party libraries vendored into the shipped client, which Mozilla pays for as it would its own code
Products and areas
Covered by Firefox / Gecko
-
verifier.accounts.firefox.com, the assertion verification that decides whether a claimed identity is genuine
Products and areas
Covered by Mozilla Accounts
-
WebAssembly: the baseline and optimising Wasm compilers, and the Wasm/JS boundary
Products and areas
Covered by SpiderMonkey
-
WebExtensions: the API surface, the install and permission flow, and the isolation between an extension and page content
Products and areas
Covered by Firefox / Gecko
No target matches. Try part of a host name, such as the company name.
Out of scope 23
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Aggressive scanning of production rather than testing on the staging instance a scope entry names
Mozilla Accounts
-
Bugs in code the reporter contributed themselves
NSS Firefox / Gecko SpiderMonkey
-
Bugs in embeddings of mozjs outside Mozilla's shipped client, GNOME Shell's gjs for instance, unless they also manifest in Firefox
SpiderMonkey
-
Bugs in third-party code that has not been incorporated into shipped Mozilla code
Mozilla Accounts
-
Bugs only reachable in the standalone js shell under flags Firefox never sets
SpiderMonkey
-
Bugs only reachable through non-Firefox consumers of NSS (Red Hat's stack, certutil, LDAP tooling, the Java PKCS#11 bridge) unless you can show the browser path
NSS
-
Denial of service that merely crashes the browser, which the program excludes in terms
Firefox / Gecko SpiderMonkey
-
Eligible model bugs must exist within the models themselves, as opposed to the software ecosystem around the model.
Mozilla
-
End-of-life branches
SpiderMonkey NSS
-
End-of-life product versions, however severe the bug
Firefox / Gecko
-
HackerOne's core ineligible findings, plus Mozilla's own custom scope exclusions layered on top
Mozilla Accounts
-
Lack of clickjacking protection on its own, and XSS that CSP blocks, which Mozilla rates low rather than high
Mozilla Accounts
-
Mozilla sites and services outside the program's listed assets, which pay only at critical severity and then at $500 to $1,000
Mozilla Accounts
-
Mozilla's own websites and services, which pay off the separate HackerOne Web Bug Bounty table
SpiderMonkey
-
Mozilla's own websites and services, which route to the separate Web Bug Bounty on HackerOne
NSS
-
Mozilla's own websites and services, which route to the separate Web Bug Bounty on HackerOne and pay off a different table
Firefox / Gecko
-
Patch gaps between Firefox and a third-party library Mozilla vendors, where that library is updated on a regular cadence
Firefox / Gecko
-
Pure crashes with no exploitability story attached
SpiderMonkey
-
Pure denial of service that merely crashes the browser
NSS
-
Reports from anyone who contributed the buggy code, and from Mozilla employees or contractors
Mozilla Accounts
-
Reports from Mozilla employees, contractors, and anyone with a business relationship with Mozilla
Firefox / Gecko SpiderMonkey NSS
-
The older Firefox for Android application, internal name Fennec, excluded by name
Firefox / Gecko
-
Weak-cipher and protocol-configuration complaints with no exploit path, which are policy arguments rather than vulnerabilities
NSS
Recent changes
Reward and scope changes across every Mozilla program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Mozilla products, from the NVD.
-
CVE-2026-106016 Critical
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
-
CVE-2026-106016 Critical
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
-
CVE-2026-106016 Critical
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
-
CVE-2026-106016 Critical
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
-
CVE-2026-106016 Critical
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
-
CVE-2026-103500 Medium
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
-
CVE-2026-103500 Medium
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
-
CVE-2026-103500 Medium
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
About this page
This page gathers every public program listed under mozilla.org and the companies Mozilla owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Mozilla.
Something wrong or missing? Report a correction.