Brave Browser

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (single unbound row, minimum) │ $10,000 │ $11,000 High │ $1,000 │ $1,250 Medium │ $250 │ $313 Low │ $100 │ $125 Submit a vulnerability CVE history 1 Last 12 months 26 Lifetime Info disclosure 35 % Access control 20 % Parsing/validation 15 % XSS 12 % Latest advisories Loading the feed Overview Brave is the largest independent Chromium fork, with monthly active users in the high tens of millions, its own security team, and its own patch set layered on top of upstream. Its footprint matters disproportionately because of what Brave adds rather than what it inherits: a Tor browsing mode, a crypto wallet holding real funds, and the adblock-rust engine that other projects vendor wholesale. A defect in Brave's own code therefore breaks exactly the privacy and custody guarantees that its users chose the browser for, which is also why its CVE count looks low: Chromium's defects are filed under the Chrome CPE, and the Brave CPE only captures Brave-specific bugs, which is precisely the surface the bounty pays for. Brave Software pays on HackerOne against one unbound reward row that runs $100 at Low, $250 at Medium, $1,000 at High and $10,000 at Critical, and because the program runs in range mode those are minimums it awards up from; $130,000 has been paid lifetime with realised top bounties between $500 and $5,300. sorona.xyz adds 1.25x on top of whatever Brave awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~7 hours First response ~10 hours Triage ~7 days Bounty In scope Brave's declaration is a repository wildcard: security or privacy issues in any repository owned by github.com/brave or github.com/brave-intl that is neither forked nor archived. The program carries it as a single source-code asset, bounty-eligible at critical maximum severity brave/brave-core , listed again as an asset in its own right. That is the engine layer, the whole patch set Brave lays over Chromium, and the whole of it is in scope The shipped clients, each an asset of its own: Brave Browser Desktop on the latest nightly, beta or stable build, com.brave.browser and com.brave.browser_beta on Google Play, and com.brave.ios.browser on the App Store The product surfaces Brave adds on top of Chromium: Shields and the adblock-rust engine behind it, Rewards, Wallet and the BAT contract addresses the policy lists, Tor windows, and sync Brave's AI and agent features, covered by a policy section the changelog added on 2025-11-26 Brave's web properties, carried at critical maximum severity: search.brave.com , account.brave.com , talk.brave.com , api-dashboard.search.brave.com , and the Creators and Ads dashboards behind the Brave websites asset row brave-intl/bat-client and brave-intl/bat-publisher , which the program names individually alongside the org-wide wildcard Out of scope Upstream Chromium bugs that Brave will simply inherit a fix for. They qualify only when Brave fixes them directly, which the policy itself calls very rare Forked and archived repositories under either GitHub organisation, which the wildcard scope carves out by name The legacy Muon-based browser, the Muon framework itself, and all LinkBubble products Fingerprinting and cross-site tracking methods in general, and detection that a user is running Brave rather than Chrome Denial of service and resource exhaustion in the client products, unless you can carry it through to code execution or data disclosure Non-default extensions, self-XSS, login and logout CSRF, and anything that needs physical access to the device Releases other than the current ones: the desktop asset row takes issues in the latest nightly, beta and stable builds only brave.com itself, where the program says it is not generally interested and does not guarantee a response, reserving consideration for severe bugs that threaten immediate user harm Most-valued findings Brave Wallet flaws that move funds, approve a transaction, or expose seed and key material without the user's consent, the shortest route to the $10,000 critical figure because real money is on the other side of it Privacy-leaking network connections from the browser itself, such as Rewards traffic for a user who never opted in or DNS escaping DoH. Info disclosure is 35% of the Brave-specific record, and this is what generates it Deanonymisation of a Tor window, or leakage between a Tor window and an ordinary one, which breaks the guarantee the feature exists to make Shields bypasses with real security impact: a path that lets tracker or ad content execute where the block was the only control standing between it and the page Prompt injection in the AI and agent features that ends in demonstrated exfiltration or an action the user never authorised Any of the above located in Brave's own patch set rather than inherited from upstream Chromium, since that is the only part of the browser this program pays for Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Upstream Chromium bugs are only eligible if Brave fixes them directly rather than waiting for the upstream fix, which the policy itself calls very rare Only current releases count, so reproduce on the latest nightly, beta or stable build and state the operating system and the Brave version you used The payable surface is Brave's own work, the patch set, Shields, Rewards, Wallet, Tor windows and sync, rather than anything inherited from Chromium Two reports closed as Not Applicable or as spam can get you banned from the program, so file only what you have actually verified Give Brave a reasonable amount of time to resolve the issue before it goes to the public or to a third party Program stats 497 Reports resolved $130k Bounties paid 100% Response efficiency Disclosure Coordinated with Brave, which asks only for a reasonable amount of time to fix an issue before anything reaches the public or a third party. That is a timing obligation rather than a bar on third-party involvement, so sorona.xyz can route the report and holds the write-up until Brave has shipped the fix in a stable release. The team is candid that it is small relative to what it protects, so allow for that in the window you expect. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability