Dart SDK

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 1 Last 12 months 7 Lifetime Parsing/validation 30 % Info disclosure 25 % Code execution 25 % Memory safety 15 % Latest advisories Loading the feed Overview Dart is the language and runtime underneath Flutter, which is the dominant cross-platform mobile UI framework, so the VM executes inside a very large number of shipped Android and iOS applications as well as desktop, embedded and server deployments. That matters for how you count blast radius: the Dart VM runs in JIT mode while a developer works and in AOT mode in every released Flutter app, so a VM defect is measured in app installs rather than in developers, and the fix has to travel through app-store update cycles before it reaches anyone. Dart also runs server-side through dart:io and compiles to JavaScript and WebAssembly for the web, which puts the same core libraries in front of untrusted network data. Google prices dart-lang/sdk at Tier OT1 on the Bug Hunters open-source VRP, $101 to $3,133.70 for a product vulnerability at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and the tier file names four Dart repositories at TIER_OT1: dart-lang/sdk plus the companions dart-lang/tools , dart-lang/test and dart-lang/build . A product vulnerability anywhere in those four is accepted, at $101 to $3,133.70 The Dart VM in full: the bytecode interpreter, the JIT and AOT compilers, the isolate model, the garbage collector, and the snapshot and kernel loaders a released binary runs on every launch The core libraries the language ships with, including dart:core , dart:async , dart:isolate , dart:typed_data , dart:convert and dart:io , together with the bounds and range checks the native implementation enforces underneath them dart:ffi and the native interop layer, the boundary at which Dart hands pointers and struct layouts to code the VM does not control The web compilation backends, dart2js and dart2wasm , and the JavaScript and WebAssembly interop the generated output relies on The front end and static tooling in the same repository: the parser, the common front end, the analyzer and the language server The in-repo command-line tooling: dart , dart compile , dart test and the pub client, including package resolution and the archives it downloads and unpacks The companion OT1 repositories: the shared packages in dart-lang/tools , the package:test runner and the build_runner code-generation stack, all of which execute on developer machines and in CI Repository configuration and the release pipelines behind the published SDK artefacts, which Google prices under its separate supply-chain category Out of scope Flutter itself ( flutter/flutter ), which Google rates OT0 and prices on its own entry rather than this one Third-party pub.dev packages that Google does not own, which fall outside the tier file entirely Any Google repository absent from the tier file, which sits at OT2 or OT3 and pays nothing for a product vulnerability Social engineering, and issues only exploitable by someone who already has maintainer or commit access Memory-corruption reports filed without exact OSS-Fuzz reproduction steps against an existing fuzz target, including how to build the image, or an already merged patch Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions Awards to researchers on a sanctions list, in a territory subject to sanctions, or located in Russia or Belarus, which Google states it cannot pay Most-valued findings A parsing or validation defect in dart:convert or dart:io that a server-side Dart process reaches straight from network data: parsing is 30% of the profile here and it is the class that reaches the top of the $3,133.70 band because it needs no user action at all Snapshot and kernel loading that treats a crafted AOT snapshot as trusted, since a released Flutter binary loads one on every launch and the loader is native code Escape from the isolate boundary into another isolate's state, which is the separation server-side embedders lean on when they run less-trusted Dart Memory corruption in the VM's C++ core reachable from pure Dart input, filed with an OSS-Fuzz reproducer so it clears the 2026 acceptance bar rather than being closed unread dart:ffi marshalling flaws that corrupt native memory from ordinary Dart code, because they defeat the language's safety guarantee without the application shipping any native code of its own A dart2js or dart2wasm codegen flaw that emits output missing a check the source enforced, which ships the bug into every site built with that compiler Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The tier file rates dart-lang/sdk TIER_OT1 alongside dart-lang/tools, dart-lang/test and dart-lang/build, so a finding has to land in one of those four repositories and product vulnerabilities cap at $3,133.70 The $13,337 figure quoted for OT1 is the supply-chain-compromise category, covering the repository or release pipeline rather than a code vulnerability in the repo Memory-corruption reports in OT0 and OT1 repositories need exact OSS-Fuzz reproduction steps against an existing fuzz target, including how to build the image, or a patch already merged upstream; non-memory-corruption reports carry no such requirement Rewards are granted on security impact alone and set by a discretionary panel, so a merged patch is a prerequisite for the memory-corruption class rather than a guarantee of payment Google cannot pay researchers on sanctions lists or in territories subject to sanctions, and no longer pays into Russia or Belarus Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters; the repository's own SECURITY.md routes reporters to dart.dev/security, and fixes are published as GitHub Security Advisories against dart-lang/sdk. Because the program's rules can be read as barring a third-party hand-off before the fix, file with Google directly and hold the detail: a VM bug reaches users only as fast as app-store updates carry a rebuilt binary. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability