Angular

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT0; supply-chain compromise is a separate category) │ $500 - $7,500 │ $625 - $8,500 Other security issue (Tier OT0 flat award) │ $1,000 │ $1,250 Submit a vulnerability CVE history 13 Last 12 months 14 Lifetime XSS 40 % Info disclosure 25 % Denial of service 20 % Access control 10 % Latest advisories Loading the feed Overview Angular is Google's enterprise web framework and one of the three frameworks large front ends are actually built on, with unusually deep penetration in banking, insurance, healthcare and public-sector portals where its opinionated structure and long-term-support releases win; Google's own consumer surfaces run on it too. Every Angular application inherits the framework's sanitiser directly, so a sanitiser bypass is a stored-XSS primitive against tens of thousands of authenticated enterprise applications at once, with no per-app misconfiguration required, and thirteen CVEs in the last twelve months show that is not theoretical. Google pays for it through the Bug Hunters open-source VRP, where all four Angular repositories sit at Tier OT0 and a product vulnerability in the project's own code runs from $500 to $7,500 at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Angular is a Google-owned GitHub organisation, which the program's own scope sentence covers, and the tier file names four of its repositories at OT0: angular/angular , angular/angular-cli , angular/components and angular/dev-infra . A product vulnerability anywhere in those four is priced at $500 to $7,500 The core framework: change detection, the dependency injection container, and the template compiler together with the rendering code it emits DomSanitizer , the bypassSecurityTrust* family, and the HTML, URL, style and resource-URL sanitisers, which the program names as a reward category of its own: "Failures in the sanitizer functions (e.g. HTML sanitizers)" Template syntax and expression evaluation, including property, attribute, class and event bindings, and the control-flow blocks the compiler expands Forms in both the reactive and template-driven flavours, and the validators applications rely on to constrain user input @angular/router : route matching, guards, resolvers, parameter and fragment handling, and lazy-loaded route boundaries @angular/common/http : interceptors, JSONP, and the XSRF token handling that guards outbound authenticated requests Server-side rendering and hydration in @angular/platform-server , including the SSR state transfer that carries server-side data into the client bundle zone.js , the async scheduling layer the framework's change detection is built on Angular Material and the CDK in angular/components : overlays, dialogs, menus, tables and every component that renders content the application did not author The ng CLI, @angular-devkit/build-angular , schematics, and the dev server and build pipeline in angular-cli angular/dev-infra , the shared build, release and CI tooling the other three repositories run through, along with npm publishing and release signing in the supply-chain category Out of scope AngularJS 1.x, which is end-of-life and does not appear in the tier file at any band Bugs in applications built with Angular rather than defects in the framework itself Developer-machine-only issues in the CLI dev server where you cannot describe a realistic attack scenario Third-party Angular component libraries, which are not Google-maintained and are not covered by the tier file Insecure application configuration chosen by a downstream integrator Repositories the tier file does not name, and releases that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue Most-valued findings A DomSanitizer or bypassSecurityTrust* bypass that lets attacker-controlled markup survive sanitisation: the program names sanitiser failures as a reward category, and XSS is 40% of Angular's CVE history, so this is the class most likely to reach the top of the $7,500 band Template compiler or expression-evaluation flaws that turn ordinary interpolated data into executing code without the application ever calling a bypass helper SSR hydration or state-transfer bugs that leak one visitor's server-rendered data into another visitor's page, the shape the 25% info-disclosure share usually takes Router guard bypass that reaches a route the application intended to protect, which is where the 10% access-control share lands XSRF token handling in @angular/common/http failing in a way that lets a cross-origin page issue authenticated requests on a user's behalf Denial of service in change detection or the compiler that a plain user-supplied input can trigger, rather than one that needs a hand-weakened development configuration Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Angular, angular-cli, components and dev-infra are all rated TIER_OT0, so a finding has to land in one of those four repositories to be priced at this band Product vulnerabilities cap at $7,500; the $31,337 figure circulating for this program is the supply-chain-compromise category, which covers source or build integrity rather than a code vulnerability in the repo The award is set by a discretionary panel, so the band is a range rather than a fixed table and a clearly written report with real impact is what moves you up it Angular's dominant bug classes are not memory corruption, so there is no OSS-Fuzz reproduction prerequisite here: a normal reproducible proof of concept is enough Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters. Google fixes on its own schedule and publishes the advisory with researcher credit, so hold any writeup until the fix has shipped. Because the program's own rules can be read as barring a third-party hand-off before the fix, file with Google directly and let sorona.xyz follow the report rather than carry it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability