BoringSSL

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Memory corruption, browser/network/GPU process from web contents, controlled write (×10 on the $500 base; the top a standalone BoringSSL bug reaches) │ $5,000 │ $6,000 Memory corruption from web contents, ASAN write/use-after-free or controlled read (×5) │ $2,500 │ $3,125 Memory corruption from web contents, ASAN read (×2) │ $1,000 │ $1,250 Base reward: below-baseline report, mitigated issue, or no harness available │ $500 │ $625 Submit a vulnerability CVE history 2 Last 12 months 7 Lifetime Memory safety 55 % Parsing/validation 20 % Info disclosure 15 % Denial of service 5 % Latest advisories Loading the feed Overview BoringSSL is Google's fork of OpenSSL and the TLS and cryptography stack inside Chrome and Chromium, which makes it the crypto layer of Edge, Brave, Opera, Vivaldi and every Electron desktop application, and of Android through Conscrypt. It is also the crypto backend of Envoy, gRPC and Cloudflare's quiche, and the upstream AWS-LC was forked from, so a certificate-validation or record-layer defect here reaches a multi-billion-device population across browsers, phones and service-mesh infrastructure at once. The seven lifetime CVEs badly understate that: most BoringSSL defects are fixed quietly as Chromium issues without a separate BoringSSL advisory ever being cut. Google pays for it through the Chrome Vulnerability Reward Program, BoringSSL's SECURITY.md tells you to file through the Chromium process and say the report is for BoringSSL, ignoring the parts specific to Chrome, and the money is built as a $500 base reward multiplied by how far you demonstrate the bug reaches, up to ×10, or $5,000, for a controlled write in the browser, network or GPU process driven from web contents. Chrome's headline six-figure numbers are for full browser exploit chains rather than for a standalone library bug, so treat $5,000 as the real top of this page. Google Patch Rewards separately rates BoringSSL Tier 1 at up to $15,000, but that is money for a patch you land upstream and keep merged, which is different work from finding the bug. sorona.xyz adds 1.25× on top of whatever Chrome VRP awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope BoringSSL's own SECURITY.md is the declaration: file through the Chromium process and say the report is for BoringSSL, ignoring the parts of that process specific to Chrome. Chrome VRP separately asks for bugs in the third-party components it ships, and this is one Google maintains itself The library as shipped in Chrome Stable, Beta and Dev, which is the build the program's severity and multiplier grid is written against libssl in full: the TLS and DTLS record layers, the handshake state machine, key exchange, session resumption, renegotiation and fragment reassembly libcrypto in full: X.509 chain building and path validation, ASN.1 and DER decoding, PKCS and PEM handling, and everything else that reads attacker-supplied structures The cryptographic primitives themselves, including implementation flaws with a demonstrated impact rather than a theoretical one Defects sitting behind default-off feature flags, which the program states are generally still eligible for the full reward Out of scope Anything the program grades below High severity, which does not qualify for a reward at all Defects with no path from web content, since the program requires a Chrome finding to be web accessible; how far that reach goes is what sets the multiplier above the $500 base MiraclePtr-protected issues, which pay nothing because the mitigation already contains them Experimental features, debugging features and unsafe flags, which the program states are not in scope Findings that do not reproduce on Google's infrastructure, which are capped at the $500 base reward however severe they look locally The six-figure rows: $250,000 and $200,000 are full Chrome exploit chains and $100,115 is a MiraclePtr bypass, none of which a standalone library bug reaches Reporters who are Chromium embedders or who hold a pre-existing business relationship with Google, who the rules say may not be eligible Most-valued findings A controlled write in the browser, network or GPU process reached from web contents through BoringSSL's parsing or record handling. That is the ×10 row, the only one that reaches $5,000, and the shape the whole grid is built to price Use-after-free or heap overflow in the TLS handshake triggered by a malicious server, since that turns every outbound connection made by a Chrome tab into the delivery path Certificate or chain validation bypass that makes a bad certificate verify, which breaks the guarantee every caller above BoringSSL depends on and is graded on impact rather than on a memory-safety multiplier Memory-safety defects in ASN.1 and X.509 decoding driven purely by attacker-supplied bytes, the largest single class in this project's CVE history at 55 percent memory safety Any of the above with a harness that runs on Google's infrastructure, because a finding that reproduces there earns its multiplier and one that does not falls back to the $500 base Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the Chromium security bug form and state in the report that the finding is for BoringSSL; you can ignore the parts of the Chromium process that are specific to Chrome itself The finding must be High or Critical severity and must reproduce on Google's own infrastructure: anything that does not lands on the $500 base reward rather than on a multiplier Reachability from web content is what sets the multiplier, so show the path a web page actually takes to the defect rather than describing it abstractly MiraclePtr-protected issues pay nothing at all; the separate six-figure MiraclePtr row is for bypassing that mitigation, not for a bug it already contains Chromium embedders and companies with a pre-existing business relationship with Google may not be eligible for rewards, which is worth reading closely before you commit time here If you also want the Google Patch Rewards money, land the fix upstream yourself and keep it merged: that is a separate pathway with its own rules and its own $15,000 Tier 1 ceiling Disclosure Coordinated through the Chromium security process, which publishes the report roughly fourteen weeks after the fix has shipped and credits the reporter. Chrome VRP's own terms say a bug disclosed to a third party for any purpose other than fixing it typically will not qualify for a reward, so file with Google first and hold everything else until the report is opened. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability