VirtualBox bug bounty programs

VirtualBox programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
VI VirtualBox Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• VI

  VirtualBox

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.virtualbox.org

  Web

• Disk image handling for VDI, VMDK, VHD and the other supported formats, plus OVF and OVA appliance import

  Products and areas

• Oracle's reporting page is the declared channel: PGP-encrypted email to the security alert address, with fixes shipped in the quarterly Critical Patch Update and credit given in the advisory. virtualbox.org routes security findings there and away from the public tracker. Nothing narrower is declared, so the whole product is in

  Products and areas

• Shared folders in full, on every host platform

  Products and areas

• The 3D acceleration and graphics stack, where guest-supplied rendering commands are interpreted by host code

  Products and areas

• The emulated network adapters, including E1000, PCnet and virtio-net, plus the user-space NAT stack behind them

  Products and areas

• The emulated storage controllers in full, including IDE, AHCI, NVMe, LsiLogic and BusLogic

  Products and areas

• The Guest Additions and every host channel they open: shared clipboard, drag and drop, guest properties, guest control, and the VBoxService and VBoxClient pair

  Products and areas

• The HGCM host-guest communication manager and every service registered on it

  Products and areas

• The host kernel drivers on Windows, macOS and Linux, including VBoxDrv and the network filter and adapter drivers

  Products and areas

• The installer and the update mechanism on each host platform, plus the Extension Pack components where they are reachable

  Products and areas

• The VMM core: the hardware virtualization backends, the recompiler paths and the instruction emulation behind both

  Products and areas

• The VRDE remote display server and any other network-facing console path

  Products and areas

• USB emulation across OHCI, EHCI and xHCI, along with the audio and graphics device implementations

  Products and areas

• VBoxSVC and the COM and XPCOM API surface, including how a less privileged host user reaches it

  Products and areas

No target matches. Try part of a host name, such as the company name.