OPPO bug bounty programs
oppo.com Updated
OPPO runs two public programs: a self-hosted bug bounty paying up to $14,400 and a HackerOne bug bounty paying up to $12,000.
- Top reward
- $14,400
- Self-hosted
- Programs
- 2
- 2 pay cash
- Targets in scope
- 133
- 5 types, deduplicated
- Last change
- 6 Nov 2026
- 6 days ago
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
OPPO OSRC
Self-hosted · Pays the most of the 2 programs: up to $14,400.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
OPPO OSRC
Self-hosted · Bug bounty |
– | – | – | – | $14,400 | – | – | 15 days promised | Open |
|
OPPO
HackerOne · Bug bounty |
$12k (highest) | $3,800 (highest) | $450 (highest) | $75 (highest) | $12,000 | Partial | – | 1 hour average | Open |
-
- First response
- 15 days promised
-
- Critical
- $12k (highest)
- High
- $3,800 (highest)
- Medium
- $450 (highest)
- Low
- $75 (highest)
- Safe harbor
- Partial
- First response
- 1 hour average
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
133 targets across all 2 programs, each listed once with the programs that cover it. 1 excluded.
No target matches. Try part of a host name, such as the company name.
Out of scope 1
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
com.fullmetalgamedev.fruitshooting
HackerOne
Recent changes
Reward and scope changes across every OPPO program, newest first.
-
Raised HackerOne
Top reward $11,500 to $12,000.
Recent CVEs
Published vulnerabilities in OPPO products, from the NVD.
-
CVE-2026-22070 High
ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.
-
CVE-2024-1608 Critical
In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction.
-
CVE-2023-26311 High
A remote code execution vulnerability in the webview component of OPPO Store app.
-
CVE-2023-26310 High
There is a command injection problem in the old version of the mobile phone backup app.
-
CVE-2021-23247 Critical
A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code execution in quick game engine
-
CVE-2021-23246 High
In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user information disclosure.
-
CVE-2021-23244 High
ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed, attacker can disguise app with the same package name to obtain dangerous permission.
-
CVE-2021-23243 High
In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used.
About this page
This page gathers every public program listed under oppo.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.