V8 bug bounty programs
v8.dev Updated
V8 runs one public program: a Sorona bug bounty paying up to $250,000.
- Top reward
- $250,000
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 10
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program V8 runs.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
V8
Sorona · Bug bounty |
$250,000 | Partial | – | – | Open |
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
10 targets. 7 excluded.
-
https://v8.dev
Web
-
Memory-safety defects in production V8 as it ships in Chrome, including type confusion, use-after-free, and out-of-bounds reads or writes reachable from JavaScript or WebAssembly; any code that reaches even a fraction of users counts as shipped
Products and areas
-
MiraclePtr / BackupRefPtr, a declarative security boundary whose bypass is explicitly in scope
Products and areas
-
Post-exploitation reach from a V8 or renderer compromise into the broader browser process, GPU process, network service, or across site-isolation boundaries, up to a full renderer-to-OS escape
Products and areas
-
The Ignition bytecode interpreter, the parser, the regular-expression engine, and V8 runtime builtins
Products and areas
-
The in-process V8 Sandbox (heap-isolation boundary), which the Chrome VRP has treated as a security boundary since Chrome 123 (March 2024): a bypass that escapes heap isolation to reach non-heap process memory is a distinct, separately rewardable finding on top of the underlying corruption
Products and areas
-
The optimizing JIT tiers, TurboFan and Maglev, where mis-optimizations and inline-cache or hidden-class (Map) type confusions turn into an attacker read/write primitive; historically roughly half of exploited V8 bugs live in a compiler
Products and areas
-
The V8 garbage collector and object-model machinery where a logic or lifetime bug yields controlled corruption of the V8 heap
Products and areas
-
The WebAssembly pipeline, including the Liftoff baseline compiler and the TurboFan wasm tier, where codegen flaws lead to memory corruption or a sandbox escape
Products and areas
-
Third-party libraries bundled into Chrome (for example libxml, sqlite, image and compression code) when a V8 bug chains through them
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 7
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Anything gated behind a flag that raises a warning infobar about user risk, or that reproduces only under --single-process, deprecated SwiftShader, or the not-yet-enabled WebNN surface
-
Bugs specific to V8 features marked Experimental (as denoted by the flag definition in source, the flag's help-menu description, or a runtime warning), which the Chrome VRP does not reward
-
Findings already reported, publicly known, or fixed on tip-of-tree at submission time
-
Issues living in third-party embedders such as Node.js integration code rather than in V8 itself
-
Pure denial-of-service, memory exhaustion, or hangs with no security-relevant primitive
-
Purely theoretical or static-analysis findings with no demonstrated security impact
-
Renderer out-of-bounds reads and DCHECK-only, SEGV-only, or plain-crash reports with no demonstrated write primitive or RCE (baseline consideration at best)
Recent changes
Reward and scope changes across every V8 program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under v8.dev: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.