Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Skia bug bounty programs

skia.org Updated

Skia runs one public program: a Sorona bug bounty paying up to $5,000.

Top reward
$5,000
Sorona
Programs
1
1 pays cash
Targets in scope
10
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Skia runs.

  • Skia

    Sorona · Bug bounty

    Open

    Top reward

    $5,000
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

10 targets. 6 excluded.

  • https://skia.org

    Web

  • Canvas2D, OffscreenCanvas, SVG filters and CSS paint surfaces as they are reached from Blink

    Products and areas

  • Mozilla pays separately under its own line on third-party libraries incorporated into shipped client code, and Skia is present in the Firefox tree at gfx/skia

    Products and areas

  • Picture recording and serialisation, plus colour management and ICC profile handling

    Products and areas

  • SkSL, Skia's shading language, and its compiler, a parser and code generator fed by page-controlled source

    Products and areas

  • Text handling: typefaces, glyph rasterisation and the font glue into FreeType and CoreText, all of it sitting on attacker-supplied glyph data

    Products and areas

  • The Chrome VRP names Skia in its own scope text, as one of the third-party components Google ships or uses, so any High or Critical bug in it that reaches Chrome qualifies

    Products and areas

  • The CPU rasteriser: paths, clips, blends, colour filters, image filters and mask filters, where geometry from a page becomes pixel arithmetic

    Products and areas

  • The Ganesh and Graphite GPU backends and the Vulkan, Metal, D3D and GL command streams they generate

    Products and areas

  • The image codec front ends Skia owns, meaning SkCodec and the PNG, JPEG, WebP, GIF, BMP and AVIF wrappers around it

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Anything below the High or Critical bar the scope sentence sets, along with low-quality submissions, which are capped at the $500 base amount

  • Code on trunk less than seven days old, which has not reached any shipping channel

  • Experimental features, debugging features and unsafe browser flags, per the program's standard exclusions

  • Reports filed to the Google OSS VRP rather than the Chrome VRP, where Skia's absence from the tier file means a product vulnerability pays nothing

  • Skia bugs reproducible only in Flutter or Android and not in Chrome, which fall outside the Chrome VRP entirely

  • Speculative reports that do not demonstrate the bug actually manifesting in a shipping browser

Recent changes

Reward and scope changes across every Skia program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under skia.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.