Android Virtualization Framework and pKVM

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Exceptional standalone vulnerability: a dynamic multiplier of an unpublished baseline; the higher chain tiers are Titan M2, Secure Element and lockscreen device targets, not reachable from this source │ $25,000 │ $26,000 Submit a vulnerability CVE history 7 Last 12 months 9 Lifetime Memory safety 40 % Access control 25 % Code execution 20 % Info disclosure 10 % Latest advisories Loading the feed Overview The Android Virtualization Framework is the AOSP component that boots protected virtual machines on arm64 Android, and pKVM is the hypervisor underneath it: an Apache-2.0 userland stack over a GPL-2.0 hypervisor living in the Android common kernel. It is enabled on Pixel 6 and later and on a widening set of arm64 devices, and it is the substrate Google chose for on-device confidential AI inference, which makes it the isolation boundary now protecting the most sensitive workloads on the platform. The CVE record is small but the direction is unmistakable: nine pKVM CVEs lifetime and seven of them in the last twelve months, two of those published three days apart in July 2026, and that count is a floor, since AVF userspace defects ship through the monthly Android Security Bulletin without matching the keyword. Google pays for it on the Android and Google Devices Security Reward Program, which names pKVM boundary defeats: host to hypervisor or pVM, pVM back to host, as a qualifying impact category in its own right. Price it carefully, though: the 2026 rewrite replaced static price sheets for single bugs with a discretionary multiplier, so $25,000 for an exceptional standalone submission is the ceiling, there is no published floor, and the top-tier table carrying the seven-figure numbers has no pKVM row on it. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The same platform and software scope as the AOSP entry, covering the whole device software stack with Android Open Source Project code named first, and pKVM boundary defeats called out separately as a qualifying impact in both directions The pKVM hypervisor in the Android common kernel: the EL2 code, the host-to-hypervisor call interface, stage-2 translation, and the memory donation and sharing rules that hold host, hypervisor and protected VM apart The trap and emulation paths a guest reaches the hypervisor through, covering guest exits, MMIO handling and interrupt injection virtualizationservice and virtmgr, the AVF userspace daemons that create, configure and supervise protected VMs for apps and system services, and the AIDL surface those callers arrive on The protected VM boot path in packages/modules/Virtualization: pvmfw, the instance disk, and the measurement and attestation chain that establishes what is running inside a pVM Microdroid, the minimal guest OS AVF boots inside a protected VM, together with its payload loading and its own userspace The AVF crosvm build, the virtual machine monitor that constructs the guest and mediates its virtio device access Code execution in hypervisors generally, which the program's arbitrary-code-execution category lists beside the TEE and Secure Elements AOSP code as it ships across Android TV, WearOS and Android Automotive OS, which the same platform-and-software scope covers Out of scope Generic upstream Linux kernel bugs without an Android-specific proof of concept, even where the code path is shared Backend and server-side services, which route to the main Google VRP rather than to this program Anything on the published Android threat-model non-bug list, closed as unactionable and ineligible for a reward Reports that rely on highly improbable preconditions or unrealistic user interaction, and findings below the program's impact thresholds Anything you cannot reproduce on an in-support Google device, so a result that only holds on an emulator or an out-of-support handset does not qualify Shell reports filed without a proof of concept to reserve a timestamp, which the program treats as noise against your account rating Submissions from Google employees and from employees of Google partner companies developing code for covered devices Payment to individuals in Russia or Belarus, which the program's sanctions screening blocks Most-valued findings A pKVM boundary defeat that achieves code execution across the hypervisor boundary in either direction, the category the program names by itself and the only shape that plausibly reaches the top of the standalone band here Memory-safety defects in the hypervisor's handling of guest-controlled state, at 40% the largest class in this project's CVE mix and the usual mechanism by which that boundary actually falls Information disclosure across the same boundary, which the program's own wording places on equal footing with code execution rather than a tier below it Access-control failures in virtualizationservice, where an app or system service reaches a VM, a device assignment or a secret it was never entitled to Escapes out of the Microdroid guest or the AVF crosvm VMM into the host, the userspace half of the same isolation promise and outside what the hypervisor's own guarantees cover Weaknesses in pvmfw and the pVM measurement chain, where a guest can be made to attest to something other than what actually booted Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A functional proof of concept is mandatory, and a proposed fix is effectively mandatory for top payouts: reports lacking one risk being deemed ineligible for financial reward or will result in a drastically reduced payout The finding has to reproduce on an in-support Google device; a result that only holds on an emulator or an out-of-support handset does not qualify Generic upstream Linux kernel bugs are out of scope without an Android-specific proof of concept Researcher accounts are rated on signal-to-noise and low-ratio accounts are rate limited, so speculative reports cost you future throughput as well as this one Sanctions screening applies, and no rewards are issued to individuals in Russia or Belarus There is no published floor, and the published top-tier table contains no pKVM row: do not size your effort against the Titan M2 or lockscreen figures Disclosure Coordinated through Google Bug Hunters, and treated as HIGH risk here: publishing before a patch exists or without Google's prior written agreement forfeits the reward and can end your participation, and that clause can be read as reaching a report routed through anyone else. File with Google directly, then let sorona.xyz track the outcome: do not send the detail anywhere until the fix is in an Android Security Bulletin. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability