ChromeOS

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (plus a patch bonus of up to $10,000) │ $5,000 - $30,000 │ $6,000 - $31,000 High (plus a patch bonus of up to $2,000) │ $2,000 - $15,000 │ $2,500 - $16,000 Medium (plus a patch bonus of up to $500) │ $500 - $1,000 │ $625 - $1,250 Any severity, panel discretion, where the finding improves overall ChromeOS security posture │ $250 │ $313 Submit a vulnerability CVE history 25 Last 12 months 508 Lifetime Memory safety 40 % Access control 25 % Code execution 20 % Info disclosure 10 % Latest advisories Loading the feed Overview ChromeOS is Google's operating system built on the Linux kernel and the Chromium OS userland, and it is the dominant OS in US and Nordic K-12 education as well as a growing enterprise thin-client platform, with tens of millions of active devices; ChromeOS Flex extends the same stack onto ordinary x86 PCs. Its security model — verified boot, minijail sandboxing, crosvm-backed VMs — is one of the few places where hardened Linux userland design is deployed at consumer scale, so a working chain here is a statement about Linux hardening generally rather than only about Chromebooks. The VRP scope line is deliberately broad: vulnerabilities anywhere in the stack, "OS components (Google and non-Google developed)" included, qualify if they put ChromeOS device users at risk, which pulls the kernel, minijail, crosvm and the shipped open-source packages inside it. Google pays $5,000 to $30,000 for a Critical, $2,000 to $15,000 for a High and $500 to $1,000 for a Medium, plus a separate patch bonus of up to $10,000 if you also land the fix, and a further $100,000 sits on top of the per-bug reward for a qualified exploit chain achieving arbitrary code execution, data exfiltration or lockscreen bypass. The $500,000 figure you may have seen quoted is a standing award for guest-mode device persistence across a reboot, which requires defeating Google-signed verified boot and dm-verity anchored in the hardware root of trust and is not reachable from open-source code alone, so it is not on the ladder below. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's scope line is deliberately broad: the entire ChromeOS stack qualifies, supported hardware and firmware included, along with "OS components (Google and non-Google developed)", so long as the defect puts ChromeOS device users at risk The Linux kernel as ChromeOS ships it, patch set and board drivers included, limited to the subset that reaches a supported device Device firmware: coreboot, depthcharge, the embedded controller, and the verified-boot and dm-verity chain anchored beneath them The Chromium OS userland: session_manager, cryptohome, shill, powerd, debugd and the rest of the system services, together with minijail, the sandbox nearly all of them are confined by crosvm and the guests it hosts, meaning the Android runtime and the Linux development environment that both run on that VMM The open-source packages carried in the shipped image, which the scope line covers as OS components whether or not Google wrote them Chromebooks, Chromeboxes and ChromeOS Flex on supported hardware, on the latest Stable, Beta or Dev channel Patches: landing the fix alongside the report earns a separate bonus scaled to the severity band Out of scope LTS-channel-only issues and AUE (end-of-life) hardware, which are outside the supported window the program rewards against Developer-mode-only bugs, which do not reach a device in the configuration users actually run Chrome browser bugs that are not ChromeOS-specific, which belong to the Chrome VRP, and Android bugs, which belong to the Android VRP Unreachable bugs, on Google's own test: "a vulnerability in a non-default configuration that cannot be changed by a user would not be considered reachable" Highly or substantially mitigated issues, where the existing defences already reduce the impact to something the panel will not price Test private keys present in public ChromeOS repositories, which are published deliberately and are not secrets Bugs already disclosed publicly, or shared with a third party for any purpose other than fixing them, which Google's rules name as disqualifying Most-valued findings A qualified exploit chain reaching arbitrary code execution, data exfiltration or lockscreen bypass without requiring persistence. It is the highest-paying reachable outcome, worth an additional $100,000 on top of the per-bug reward, and the one chain class open-source code can actually deliver Memory corruption in a device-reachable component that reaches code execution: memory safety is 40% of the distribution here and the usual first link of a chain, priced up to $30,000 as a Critical Sandbox escape out of minijail, or a guest escape out of crosvm, since both are the confinement the rest of the model assumes holds Access-control failures that cross a session or user boundary, 25% of the distribution and the class that turns a shared education or enterprise device into a data-exposure event Any of the above delivered from a web page against a stock device, without asking the user to weaken the configuration first, because that is the reachability standard the panel grades against Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Demonstrate the bug on supported hardware running the latest Stable, Beta or Dev channel: LTS-channel-only issues and AUE (end-of-life) devices do not qualify The device must be in its shipped configuration: Developer-mode-only findings are excluded, and Google's reachability test is that "a vulnerability in a non-default configuration that cannot be changed by a user would not be considered reachable" Route by product, not by device: Chrome browser bugs that are not ChromeOS-specific belong to the Chrome VRP and Android bugs to the Android VRP Send a patch with the report if you can: it earns a separate bonus per severity band, up to $10,000 on a Critical Google's rules disqualify "bugs disclosed publicly or to a third-party for purposes other than fixing the bug", so file with Google first and treat the disclosure clock as theirs Disclosure Coordinated through Google Bug Hunters, which triages and pays on Google's own schedule and publishes credit once a fix has shipped to the affected channels. Google's rules treat disclosure to a third party for any purpose other than fixing the bug as disqualifying, so file with the VRP yourself, hold the detail until Google has released, and route the report to us afterwards. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability