Chromium

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Full chain exploit from web contents │ $250,000 │ $251,000 Full chain exploit requiring MojoJS │ $200,000 │ $201,000 MiraclePtr bypass │ $100,115 │ $101,115 UXSS or site isolation bypass (High Impact) │ $10,000 │ $11,000 Memory corruption from web contents, controlled write in the browser, network or GPU process │ $5,000 │ $6,000 Base reward (below-baseline report, mitigated issue, or no harness available) │ $500 │ $625 Submit a vulnerability CVE history 1,817 Last 12 months 5,475 Lifetime Memory safety 52 % Access control 21 % Parsing/validation 7 % Denial of service 5 % Latest advisories Loading the feed Overview Chromium is the highest-blast-radius codebase in open source. It is the engine of Chrome, Edge, Brave, Opera, Vivaldi, Samsung Internet and Arc; of Android WebView, which renders in-app content on billions of handsets; of Electron, and therefore of VS Code, Slack, Discord, Teams, Signal Desktop and Figma Desktop; of ChromeOS; and of every headless-Chrome scraping, rendering and PDF-generation pipeline in CI. A Blink parsing bug is simultaneously a desktop bug, a mobile bug, a kiosk bug and a server-side bug, which is why 5,475 CVEs carry the Chrome CPE and 1,817 of them were published in the last twelve months. Google runs the busiest vulnerability reward program on earth against it, and the ladder is unusually wide: $500 for a below-baseline report, $5,000 for a controlled write in the browser, network or GPU process reached from web contents, $10,000 for a UXSS or site-isolation bypass, $100,115 for a MiraclePtr bypass, and $250,000 for a full chain exploit that succeeds from web contents. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's declaration is one sentence: any High or Critical severity bug in Chrome Browser may be considered, qualified only by the requirement that it reach the Stable, Beta or Dev channel The Blink rendering engine and the web platform it implements: DOM, CSS, layout, the HTML parser and the APIs a page can call V8, covering the JavaScript and WebAssembly engines and the V8 sandbox, which the reward table prices on rows of its own The browser process, the network service, the GPU process, the utility processes, and the Mojo IPC layer that connects them Site Isolation and the renderer sandbox across Windows, macOS, Linux, Android, ChromeOS and Fuchsia The extensions system, WebUI, the Omnibox, and the permissions and security UI surface, with URL spoofing and web-platform privilege escalation priced on their own rows Third-party components shipped with Chrome, which the rules name explicitly, giving PDFium and Skia as the examples GPU driver bugs reachable from the renderer, which the rules describe as user-mode GPU driver bugs in Mesa or Mali drivers Chrome's built-in AI features, which the reward table carries on separate rows for rogue actions and for sensitive data exfiltration Out of scope Experimental features, debugging features and unsafe flags, none of which represent a configuration users are exposed to MiraclePtr-protected use-after-free in non-renderer processes, which the program now records as PROTECTED under BRP-ASAN rather than as a security bug Code on trunk less than seven days old, which has not reached any shipping channel Server-side Google services, which route to the main Google VRP rather than to the Chrome program Speculative reports that do not demonstrate the bug actually manifesting in Chrome Anything below the High or Critical bar the scope sentence sets, along with low-quality submissions, which are capped at the $500 base amount regardless of the class of bug described The full-chain rung is capped by budget as well as by difficulty: only four exploit bonuses will be paid in 2026, so a fifth complete chain has no band left to land on Most-valued findings A full chain exploit from web contents that gets from an ordinary web page to code execution outside the sandbox. It is the $250,000 rung and the only submission the program treats as a complete attack rather than a component of one Memory corruption in the browser, network or GPU process driven from web contents with a controlled write, which tops the standard table at $5,000 and is the building block every chain is assembled from UXSS or a site-isolation bypass that reads another origin's data, since it defeats the boundary the entire multi-process architecture exists to enforce Renderer sandbox escapes reached over Mojo IPC, where a compromised renderer talks to a privileged process and the trust boundary is a deserialiser A MiraclePtr bypass that turns a supposedly-protected use-after-free back into an exploitable one, which the program prices on its own at $100,115 precisely because it invalidates a mitigation rather than one bug Anything in the 52% of Chrome CVEs that are memory-safety defects, demonstrated on a default configuration in a shipping channel rather than one the reporter had to weaken Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The bug must manifest in an active Stable, Beta or Dev channel and be reachable on the latest operating system and 64-bit hardware; a crash that only reproduces elsewhere does not qualify Code less than seven days old on trunk is excluded, so a regression caught the day it lands pays nothing MiraclePtr-protected use-after-free in a non-renderer process is no longer treated as a security bug, and a report marked PROTECTED under BRP-ASAN closes on that basis Experimental features, debugging features and unsafe command-line flags are out of scope, so demonstrate the bug in a configuration a normal user actually runs Only four full-chain exploit bonuses will be paid in 2026, which caps the $250,000 rung by budget as well as by difficulty A report that does not demonstrate the bug manifesting in Chrome, or that lands below the program's quality baseline, is capped at the $500 base amount Disclosure Coordinated through the Chromium issue tracker under Google's Bug Hunters rules, and the clock is Google's: reports are made public 14 weeks after being marked as fixed. Hold the detail until the program confirms a fix has shipped and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability