Android Runtime (ART) and libcore

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Exceptional standalone vulnerability: a dynamic multiplier of an unpublished baseline; the higher chain tiers are Titan M2, Secure Element and lockscreen device targets, not reachable from this source │ $25,000 │ $26,000 Submit a vulnerability CVE history 15 Last 12 months 150 Lifetime Memory safety 35 % Code execution 30 % Access control 20 % Parsing/validation 10 % Latest advisories Loading the feed Overview ART is the managed virtual machine every Android application executes inside, and libcore is the java.* standard library those applications call, together, plausibly the most-executed managed runtime on earth by installed base, running on roughly three billion active devices. It is also the boundary that separates one app from another, which means a single escape out of the runtime is a universal app-sandbox break rather than a defect in one product; and because ART and libcore now ship as a Mainline APEX module updated out of band, a fix reaches devices without a full OS update, which raises the value of a finding rather than lowering it. Google pays for it on the Android and Google Devices Security Reward Program, which names Android Open Source Project code first in its platform-and-software scope and then names the exact bug classes a managed runtime produces, arbitrary code execution across privileged, unprivileged and constrained contexts, and viable deserialization gadget chains, Parcel Mismatch among them. Read the money carefully. The program replaced its static price sheet for single vulnerabilities with a discretionary multiplier of a baseline it does not publish, so $25,000 is what an exceptional standalone submission can reach and there is no published floor at all, while the $150,000 to $1,500,000 figures on the same page are full exploit chains against Pixel and Titan M2 hardware rather than single runtime bugs. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The program's platform and software scope covers the device software stack "including but not limited to" Android Open Source Project code, which it names first. ART and libcore are AOSP code, and a single runtime bug is priced on the standalone row ART in full: the interpreter, the optimizing compiler, dex2oat ahead-of-time compilation, the JIT and the garbage collector DEX and CompactDex file parsing and verification, including the bytecode verifier that decides whether attacker-supplied code is allowed to run at all libcore, Android's java.* standard library implementation, serialization included The JNI boundary and the Java-to-native transition, where managed guarantees stop applying and raw memory begins Parcel and Parcelable serialization across the Android Framework. The rules name Parcel Mismatch as a qualifying gadget-chain class and name arbitrary code execution across privileged, unprivileged and constrained contexts as a qualifying impact The app sandbox boundary as the runtime enforces it, which is what separates one installed application from another The rest of the AOSP device software stack sits under the same declaration. This page covers the ART and libcore trees inside it Out of scope Upstream Linux kernel and generic Linux components, "unless the reporter provides a functional Proof of Concept demonstrating a direct, exploitable impact specifically on Android or Pixel-maintained modules" Google backend services and server-side APIs, which belong to the separate Google and Alphabet VRP rather than to this program Devices within 90 days of the end of their guaranteed security updates Issues already covered by Android's published threat models and known-non-bug list Non-Pixel OEM devices, which do not satisfy the hardware-reproduction requirement even when the underlying code is identical. The proof of concept has to run on the latest public build of supported Pixel, Nest or Fitbit hardware Individuals and entities in Russia or Belarus, who cannot be paid, along with anyone else the sanctions rules reach Most-valued findings A standalone memory-safety defect in ART that yields a genuinely new primitive rather than another instance of a known pattern. The program prices exceptional standalone research at the top of its dynamic band, and memory safety is 35% of this component's history, so this is where the $25,000 actually lives Arbitrary code execution crossing a privilege boundary out of the runtime: unprivileged app to system, or the runtime to native and then to kernel, which the rules name as a qualifying impact in its own right Deserialization and gadget chains through libcore or Parcel. A Parcel Mismatch that makes the writer and the reader disagree about a structure's layout, ending in code execution or a privileged side effect Bytecode verifier or DEX-parsing flaws that let a crafted DEX file run code the verifier was supposed to reject, since the verifier is the gate every installed app passes through App-sandbox escapes reachable from one installed application to another's data, which on three billion devices is the same bug repeated three billion times Any of the above delivered with a working proof of concept on current Pixel hardware and a proposed patch, since that combination is the difference between a paid report and an ineligible one Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A functional proof of concept is mandatory and it has to reproduce on the latest public build of supported Pixel, Nest or Fitbit hardware: a runtime bug you can only demonstrate on an emulator or a non-Google device does not clear the bar Attach a proposed patch: it materially raises the discretionary multiplier, and its absence can make the report ineligible outright Upstream Linux kernel and generic Linux defects are out of scope unless your proof of concept shows direct, exploitable impact specifically on Android or on a Pixel-maintained module Standalone rewards are a discretionary multiplier of a baseline Google does not publish, so treat $25,000 as a cap on exceptional work rather than a price you can plan against The $150,000 to $1,500,000 tiers on the same page are full chains against Pixel and Titan M2 hardware; a single ART or libcore bug is priced on the standalone row and nowhere else Sanctions rules apply, and rewards are not issued to individuals or entities in Russia or Belarus Disclosure Coordinated through Google Bug Hunters, which credits researchers in the monthly Android Security Bulletins and on the AOSP acknowledgements page, so publication follows the bulletin rather than a clock you control. The program also treats privately disclosing a flaw to a third party for any purpose other than fixing it as against its spirit, and says such reports typically will not qualify: consistent with the HIGH grade, file with Google yourself first and route the finding to us afterwards. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability