Android (AOSP)

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Exceptional standalone vulnerability: a dynamic multiplier of an unpublished baseline; the higher chain tiers are Titan M2, Secure Element and lockscreen device targets, not reachable from this source │ $25,000 │ $26,000 Submit a vulnerability CVE history 798 Last 12 months 9,259 Lifetime Memory safety 40 % Access control 25 % Info disclosure 20 % Code execution 10 % Latest advisories Loading the feed Overview The Android Open Source Project is the base of roughly three billion active devices and of the entire non-Google Android world sitting on top of it: Samsung One UI, Xiaomi HyperOS, Amazon Fire OS, and a very long tail of embedded, automotive and set-top builds. By device count it is the most widely deployed open-source userland on earth, and its record reflects that: 9,259 CVEs lifetime, 798 in the last twelve months, with memory safety accounting for about 40% of them. Google pays for it on the Android and Google Devices Security Reward Program, which names AOSP first in its platform-and-software scope, but two things about that program have to be read carefully before you commit weeks to it. The April 2026 rewrite removed the static price sheet for single vulnerabilities in favour of a discretionary multiplier of an unpublished baseline, so the only firm number is the $25,000 an exceptional standalone submission can reach and there is no published floor at all. And the headline millions on the same page: $1,500,000 for a Titan M2 chain with persistence, $150,000 for a software lockscreen bypass; are silicon and chain targets that AOSP source alone does not get you to. The reward also follows Google hardware rather than the source tree, which means AOSP's blast radius is far larger than the surface that actually pays. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The program's platform and software scope covers the whole device software stack, names Android Open Source Project code first, and states in its own words that the list is not exhaustive The AOSP tree itself, the Apache-2.0 userland over the GPL-2.0 Android common kernel, as it ships on eligible Google devices The framework and system services layer: system_server, Binder and the AIDL interfaces crossing it, PackageManager, ActivityManager, and the permission model they enforce The media, graphics and codec stack, plus the Bluetooth, NFC, Wi-Fi and telephony stacks, and every parser on those paths that handles bytes the device never asked for Kernel drivers, hardware abstraction layers, and the init, SELinux policy and system property surfaces that decide what a compromised process can do next Keystore and KeyMint, the bootloader chain, verified boot and device firmware, alongside the Trusted Execution Environment and Secure Elements the same scope sentence lists Hypervisors, named in the program's arbitrary-code-execution category, which reaches pKVM boundary defeats between host, hypervisor and protected VM The same code as it ships in Android TV, WearOS and Android Automotive OS builds, all three named in the scope sentence OEM proprietary code and drivers shipped on eligible devices, listed in that same sentence beside AOSP The impact categories the program grades against: code execution across privileged, unprivileged and constrained contexts, permission bypass, Private Space and cross-user data access, Device Policy Controller removal, and destructive remote denial of service requiring a factory reset Out of scope Upstream Linux kernel and generic Linux components, absent a proof of concept demonstrating direct Android or Pixel-maintained-module impact Google backend services and APIs, which belong to the separate Google and Alphabet VRP rather than to this program Anything on Android's published threat model and known-non-bug list, closed as unactionable and ineligible for a reward Reports resting on highly improbable preconditions or unrealistic user interaction, and findings below the program's impact thresholds Anything you cannot reproduce on an in-support Google device: the reward follows the hardware, so AOSP reach on its own does not pay Reports filed without a functional proof of concept, including shell reports that exist to reserve a timestamp, and memory-corruption reports filed without a proposed patch Submissions from Google employees and from employees of Google partner companies developing code for covered devices Payment to individuals in Russia or Belarus, which the program's sanctions screening blocks Most-valued findings A standalone memory-safety bug that yields a genuinely new primitive rather than another instance of a known pattern. The program prices exceptional standalone research at the top of its dynamic band, and memory safety is 40% of Android's CVE history, so this is where the $25,000 actually lives. Code execution that crosses a privilege boundary: unprivileged app to system, system to kernel, or anything reaching the TEE, a Secure Element or the hypervisor Remote parser bugs on the media, Bluetooth, NFC and telephony paths, where the input arrives without the user having chosen to accept it Permission and access-control failures that reach another user's or another profile's data: Private Space escapes, cross-user reads, and Device Policy Controller removal on a managed device Information disclosure crossing an app or user boundary, 20% of the recorded history and usually easier to demonstrate cleanly than a full chain Destructive remote denial of service that leaves a device needing a factory reset, which the program treats as an impact class in its own right rather than as a nuisance crash Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A functional proof of concept is mandatory, and a proposed patch is mandatory on top of it for any memory-corruption report Upstream Linux kernel bugs are out of scope unless your proof of concept shows direct impact on Android or on a Pixel-maintained module Nothing may be published before a patch is available or without Google's prior written agreement: the stated penalty is immediate disqualification from reward and possible removal from the program Standalone rewards are a discretionary multiplier of a baseline Google does not publish, so treat $25,000 as a cap on exceptional work rather than a price you can plan against, and expect no published floor The money follows the device: the program covers the software stack as it ships on eligible Google hardware, so a finding you cannot demonstrate there is worth much less than its AOSP reach suggests Employees of Google, and of Google partner companies developing code for covered devices, cannot be paid Disclosure Coordinated through Google Bug Hunters. Publishing before a patch exists, or without Google's prior written agreement, forfeits the reward and can end your participation, so publication timing is Google's rather than a fixed clock. File it, let Google ship the fix, and sorona.xyz holds the detail until the Android Security Bulletin carries it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability