Firefox / Gecko

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Highest Impact: a sandbox escape, or bypassing a WebExtension install prompt ($18,000 baseline, $20,000 with a high-quality report) │ $20,000 │ $21,000 Higher Impact: universal XSS ($8,000 baseline, $10,000 with a high-quality report) │ $10,000 │ $11,000 High Impact: other sec-high work such as an address-bar spoof, GPU-process memory corruption, or parent-to-child information disclosure ($3,000 baseline, and examples typically land at $3,000) │ $5,000 │ $6,000 Moderate Impact, at the committee's discretion │ $2,500 │ $3,125 Memory corruption triggered by an out-of-memory condition (typical award) │ $1,500 │ $1,875 Denial of service that persists across restarts, or that requires a machine reboot (typical award) │ $1,000 │ $1,250 Submit a vulnerability CVE history 406 Last 12 months 3,284 Lifetime Memory safety 55 % Code execution 15 % Info disclosure 12 % XSS 8 % Latest advisories Loading the feed Overview Gecko is the layout and rendering engine inside Firefox, and the last major browser engine whose vendor is not also a platform owner. Its reach is wider than Firefox's market share suggests: it renders Tor Browser, Mullvad Browser, LibreWolf, Waterfox, Zen and Floorp, it is what Thunderbird draws mail with, and its ESR builds sit on enterprise and government desktops with multi-year support tails. Every one of those installs turns markup, CSS, fonts, images and media from an arbitrary website into engine state, which is why the project carries 3,284 CVEs over its life and 406 in the last twelve months. Mozilla Corporation pays for these itself through the Client Security Bug Bounty on Bugzilla: $20,000 at the top for a sandbox escape, $10,000 for a universal XSS, $5,000 for other sec-high work. sorona.xyz adds 1.25× on top of whatever Mozilla awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Any security bug in the main development or released versions of Firefox, Firefox for Android and Firefox for iOS as Mozilla Corporation ships them. The program names Nightly mozilla-central and Beta builds alongside the final releases, and the mobile applications count as targets in their own right. Gecko itself: layout, the DOM, CSS, the HTML and XML parsers, SVG and the image decoders SpiderMonkey, the JavaScript and WebAssembly engine, in-tree at js/src and covered by this same table The networking stack under netwerk/: URL parsing, HTTP handling, caching, cookies and origin attribution, together with NSS for TLS and certificate validation Graphics and media: WebRender, the GPU process, playback and the bundled codecs The content-process sandbox and the parent/child IPC boundary, IPDL The browser front end: the address bar and security indicators, permission and install prompts, downloads, the password manager, and profile and update handling WebExtensions: the API surface, the install and permission flow, and the isolation between an extension and page content Third-party libraries vendored into the shipped client, which Mozilla pays for as it would its own code Out of scope Denial of service that merely crashes the browser, which the program excludes in terms End-of-life product versions, however severe the bug The older Firefox for Android application, internal name Fennec, excluded by name Patch gaps between Firefox and a third-party library Mozilla vendors, where that library is updated on a regular cadence Bugs in code the reporter contributed themselves Reports from Mozilla employees, contractors, and anyone with a business relationship with Mozilla Mozilla's own websites and services, which route to the separate Web Bug Bounty on HackerOne and pay off a different table Most-valued findings A content-process sandbox escape: attacker code running with full user privileges in the parent process. It is the Highest Impact row and the only route to the $20,000 ceiling. Bypassing a WebExtension install or permission prompt, priced on that same top row because it quietly puts persistent attacker code in the user's profile Universal XSS, where script from one origin executes in another and the same-origin policy stops holding, at $10,000 Memory corruption in the GPU process, or across the parent/child IPC boundary, and parent-to-child information disclosure, which is where most sec-high work lands Memory-safety defects driven purely by page content in layout, the DOM or the parsers, the class behind 55% of Firefox's CVE history An exploit-mitigation bypass demonstrated without privileged access, which Mozilla treats as High Impact and then tops up with 50% of the category baseline as a bonus Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Your finding normally has to reach Mozilla's sec-high or sec-critical rating; below that, payment is at the committee's discretion Mozilla reserves a seven-day window for its own automated tooling, so a bug its fuzzers reach first is not eligible If two reports of the same bug arrive within 48 hours of each other, the bounty is split between them Do not put CVSS scores or CWE identifiers in the report; Mozilla's rules ask you to describe the impact instead End-of-life products are ineligible, as are bugs in code you contributed yourself File on Bugzilla through the client bounty form at bugzilla.mozilla.org/form.client.bounty Disclosure Coordinated with Mozilla through Bugzilla. The bug sits in a security-restricted group until a fix rides a release train, and Mozilla then publishes an MFSA advisory with researcher credit. Its terms ask for a reasonable amount of time before any part of the issue is shared with a third party, so hold the detail until that advisory is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability