coreboot

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Rewards column; a patch bonus of up to $10,000 is separate, and the $500,000 headline is a full guest-mode persistence chain rather than a firmware bug) │ $5,000 - $30,000 │ $6,000 - $31,000 High (patch bonus of up to $2,000 separate) │ $2,000 - $15,000 │ $2,500 - $16,000 Medium (patch bonus of up to $500 separate) │ $500 - $1,000 │ $625 - $1,250 Any severity, at panel discretion, for improving overall ChromeOS security posture │ $250 │ $313 Submit a vulnerability CVE history 0 Last 12 months 1 Lifetime Memory safety 35 % Auth bypass 30 % Parsing/validation 20 % Access control 10 % Latest advisories Loading the feed Overview coreboot is the open-source x86 and Arm boot firmware that replaced the proprietary BIOS on every Chromebook and Chromebox ever shipped: on the order of tens of millions of active devices, concentrated in education, and beyond ChromeOS it is the firmware in System76, Star Labs and Purism machines, the Framework Laptop's upstream lineage, and a meaningful slice of hyperscaler and OCP server firmware. It is also the base for Dasharo and Heads. A coreboot flaw sits beneath the operating system, beneath verified boot, and survives a powerwash, which is precisely why the ChromeOS VRP's persistence-focused headline award exists at all. The project pays nothing itself; Google does, through the ChromeOS VRP, which scopes the entire ChromeOS stack including non-Google-developed firmware. A firmware report tops out at $30,000 in the Rewards column, with a separate patch bonus of up to $10,000 if you also supply the fix: the $500,000 headline is a standing award for a full guest-mode device-persistence chain delivered via a web page, not for a firmware bug. The near-zero CVE record is an attribution artefact rather than a measure of code quality: coreboot findings are absorbed into ChromeOS and vendor advisories instead of carrying a coreboot-attributed CVE. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's declaration is a stack rather than a repository list: "Vulnerabilities discovered in the entire ChromeOS stack, including but not limited to supported hardware, firmware, OS components (Google and non-Google developed), are considered eligible for reward if they put ChromeOS device users at risk." coreboot is the non-Google firmware in that stack, so it is covered by category, and the report has to land on a supported Chromebook or ChromeOS Flex device coreboot as Chromebooks ship it, across the whole boot flow: bootblock, romstage, ramstage, postcar and the payload handoff vboot, the verified-boot implementation, together with the write-protect and rollback-counter enforcement that anchors it depthcharge and the rest of the ChromeOS firmware payload chain up to the kernel SMM handlers and the SMI interface on x86 Chromebooks, which stay resident and privileged for the life of the running system CBFS parsing, FMAP handling and the firmware-update path that writes new images Platform init for shipping Chromebook mainboards, covering Intel and AMD SoC init and the Arm ports The coreboot-side interfaces to the embedded controller and the security chip, where early boot code acts on what another component reports Out of scope Non-Chromebook coreboot ports, which are by far the largest part of the tree and put no ChromeOS device user at risk Developer-mode-only findings, LTS-channel-only findings, and anything the platform already mitigates Devices outside the supported set: hardware no longer supported, or a device not running the latest ChromeOS in Stable, Beta or Developer in verified mode Anything requiring open-chassis physical modification, such as defeating the write-protect screw or reflashing the SPI part directly Bugs already disclosed publicly or handed to a third party for purposes other than fixing them The $500,000 standing award and the $100,000 chain award, both of which require a full exploit chain defeating Google-signed verified boot. A coreboot component bug is priced on the ordinary severity ladder and caps at $30,000 Most-valued findings A verified-boot bypass: anything that lets an unsigned or rolled-back firmware image run, or that defeats the rollback counter and write-protect enforcement. That is the Critical class this ladder's $30,000 top exists for Persistent firmware compromise reachable without opening the case. Code that survives a powerwash is the outcome the whole ChromeOS threat model is built to prevent, and auth bypass is 30% of the recorded distribution here Memory-safety defects in early boot parsing driven by attacker-controllable bytes: CBFS entries, firmware-update payloads and vboot structures, memory safety being the largest class at 35% SMM handler flaws on x86 Chromebooks, where a bug in code that outlives the OS gives an attacker a privilege level the kernel cannot inspect or revoke Defects in the firmware-update path itself, the one route by which an OS-level compromise becomes a firmware-level one and therefore permanent A patch alongside the report: the bonus is a separate line worth up to $10,000 on a Critical, and coreboot findings are absorbed into ChromeOS advisories rather than carrying their own CVE, so the fix is the part that travels Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The bug must affect a Chromebook or ChromeOS Flex device on supported hardware running the latest ChromeOS in the Stable, Beta or Developer channel, in verified mode: that is the program's binding constraint, not a preference Developer-mode-only findings and LTS-channel-only findings are excluded, as are findings the platform already mitigates The $500,000 headline is a standing award for a guest-to-guest device-persistence chain delivered via a web page, and $100,000 more applies to a qualified exploit chain; a coreboot report is priced on the ordinary severity ladder and tops out at $30,000 Supply the fix as well as the report if you can: the patch bonus is a separate line of up to $10,000 on a Critical, $2,000 on a High and $500 on a Medium coreboot is covered by category rather than named by repository, so the report has to show the bug puts ChromeOS device users at risk: that framing is what makes it eligible Bugs disclosed publicly or to a third party for purposes other than fixing them are ineligible, and Google discloses on its own 14-week clock Disclosure Coordinated through Google Bug Hunters on the ChromeOS VRP, which runs a published 14-week disclosure clock and typically assigns a CVE against ChromeOS rather than against coreboot for Critical, High and Medium findings. Because a bug disclosed to a third party for any purpose other than fixing it is ineligible, file with Google directly, and expect the fix to reach devices through a firmware update rather than a coreboot release. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability