ANGLE

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Memory corruption from web contents, controlled write in the browser, network or GPU process (this project's ceiling; the $250,000 full-chain rungs need a complete Chromium exploit) │ $5,000 │ $6,000 Memory corruption from web contents, ASAN write or use-after-free │ $2,500 │ $3,125 Memory corruption from web contents, controlled read │ $2,500 │ $3,125 Memory corruption from web contents, ASAN read │ $1,000 │ $1,250 Base reward (below-baseline report, mitigated issue, or no harness available) │ $500 │ $625 Submit a vulnerability CVE history 116 Last 12 months 174 Lifetime Memory safety 55 % Parsing/validation 20 % Access control 12 % Info disclosure 8 % Latest advisories Loading the feed Overview ANGLE is how WebGL and WebGPU reach real GPUs, and it is not only Chrome's. It is used by Chrome, Edge, Brave, Opera and every other Chromium browser; by Firefox on Windows for WebGL; by Android as the OpenGL ES driver on a growing share of devices; and as the graphics translation layer inside a large number of games and emulators shipped through app stores. A validation gap in ANGLE is a path from JavaScript to the GPU driver, and a path to the GPU driver is a path to the kernel. It is also, right now, the single most CVE-productive named component in Chrome: 116 of its 174 lifetime Chrome CVEs were published in one recent quarter, ahead of V8, the GPU process, Media and Skia; a fact a CPE-based sweep misses entirely, because ANGLE's own CPE carries just one. Google pays $500 for a below-baseline report and up to $5,000 on the standard table for a controlled write reached from web contents, with a full chain built on the bug separately eligible for $250,000. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The Chrome VRP takes any High or Critical severity bug in Chrome Browser, and ANGLE is Chromium project code on chromium.googlesource.com, so it is covered directly rather than as a vendored dependency The OpenGL ES and EGL entry points and the validation layer in front of them, meaning every call a page can drive through WebGL or WebGPU The shader translator and its SPIR-V, HLSL, MSL and GLSL emitters, which run on shader source the page writes Every backend ANGLE ships: D3D11 on Windows, Metal on Apple platforms, Vulkan on Linux, Android and ChromeOS, plus the OpenGL passthrough and null backends Resource and state management for textures, buffers, framebuffers, programs, samplers and transform feedback, together with the size and format validation applied to each Context, surface and sync-object handling in the EGL layer, including state shared between contexts The path Blink and the GPU command buffer take into ANGLE, where the browser's API contract turns into ANGLE calls Out of scope Anything below the High or Critical bar the scope sentence sets, along with low-quality submissions, which are capped at the $500 base amount GPU-vendor driver bugs, which the Chrome scope handles under a separate line covering user-mode Mesa and Mali drivers rather than as ANGLE findings Configurations behind non-default flags, which fall under the experimental-features exclusion Experimental and debugging features generally, per the program's standard exclusions Code on trunk less than seven days old, which has not reached any shipping channel Reports filed to the Google OSS VRP rather than the Chrome VRP, where ANGLE's OT2 placement means a product vulnerability pays nothing Speculative reports that do not demonstrate the bug actually manifesting in a shipping browser Most-valued findings A controlled write in the GPU process driven from WebGL or WebGPU. That is the top of the standard table at $5,000 and the shape most of ANGLE's 116 recent CVEs take Shader translator memory corruption on page-supplied GLSL or WGSL. The translator and its SPIR-V, HLSL and MSL emitters are historically the richest bug source in the project, and they run on wholly attacker-controlled input Validation bypass in texture, buffer or framebuffer state that lets a page issue a draw the driver was never meant to see, since that is the step before a driver or kernel bug Integer overflow in size and stride arithmetic, the 20% parsing-and-validation share, which reliably converts into an undersized allocation the GPU then writes past Cross-process or cross-origin information disclosure through uninitialised GPU memory read back into a canvas, which reaches the user-information-disclosure rung rather than the base amount Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File to the Chrome VRP, not the Google OSS VRP: ANGLE is absent from Google's OSS VRP tier file, which places it in OT2 where product vulnerabilities pay nothing The bug must be reachable through WebGL or WebGPU from a normal web page; anything that needs a non-default flag falls under the experimental-features exclusion The bug must manifest in an active Stable, Beta or Dev channel on the latest operating system and 64-bit hardware, and code less than seven days old on trunk is excluded A defect in the GPU vendor's own driver is handled under a separate line in the Chrome scope covering user-mode Mesa and Mali driver bugs, not as an ANGLE bug: be clear which side of that line your finding sits on Say which backend you reproduced on: ANGLE's D3D11, Metal, Vulkan and GL passthrough paths are different code, and a bug on one is not automatically a bug on the others Disclosure Coordinated through the Chromium issue tracker, where reports are made public 14 weeks after being marked as fixed. Hold the detail until the program confirms a fix has shipped and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability