Flutter

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT0; supply-chain compromise is a separate category) │ $500 - $7,500 │ $625 - $8,500 Other security issue (Tier OT0 flat award) │ $1,000 │ $1,250 Submit a vulnerability CVE history 2 Last 12 months 6 Lifetime Info disclosure 30 % Access control 25 % Code execution 25 % Parsing/validation 15 % Latest advisories Loading the feed Overview Flutter is Google's cross-platform UI toolkit and the most-starred repository in Google's entire open-source tier file, backed in this case by real deployment: it is the framework behind Google Pay, Google Ads, Google Classroom, the My BMW app, eBay Motors, Nubank and a very large share of new cross-platform mobile development, particularly in fintech across Latin America and Asia. A framework-level flaw ships compiled inside application binaries on hundreds of millions of phones and can only be remediated by every app author rebuilding and re-releasing, which is the slowest remediation path of any project on this program. The interesting surface is the platform-channel boundary, where Dart code crosses into native Android and iOS privileges. Google pays for reports through the Open Source Software VRP: flutter/flutter is Tier OT0, where a product vulnerability runs from $500 to $7,500 and a discretionary panel decides where in that band a finding lands. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's tier file names two repositories: flutter/flutter at OT0, where a product vulnerability is priced at $500 to $7,500, and flutter/devtools at OT1, capped at $3,133.70. Both are covered whole, with no component of either carved out The framework layers: widgets, rendering, gestures, animation, and the semantics tree assistive technology reads The engine shipped in the same repository, including dart:ui , the Skia and Impeller rasterisers, and text shaping Image, font and asset decoding paths reached from network content, including malformed media that reaches a decoder before any application check Platform channels and the method, event and message channel boundary between Dart and native code, the crossing from framework code into platform privileges The platform embedders for Android, iOS, macOS, Windows, Linux and the web, and the platform views that host native widgets inside a Flutter surface flutter_tools : the build pipeline, pub dependency resolution, artifact download and verification, and the code-signing steps that produce a shippable binary Web rendering output from both the CanvasKit and HTML renderers, and any markup the framework emits into the page The flutter CLI itself, including channel switching and the version and artifact management it performs DevTools: the debug service connection, VM Service protocol exposure and the DevTools web application itself Out of scope Applications written in Flutter rather than defects in the framework that ships to them The Dart SDK and language runtime, which is a separate tier-file entry ( dart-lang/sdk ) with its own band The plugins in flutter/packages , which the tier file does not name, along with third-party packages published on pub.dev Platform-specific bugs owned by Android or iOS rather than by Flutter's own code Debug-mode-only behaviour that is documented as insecure and disabled in release builds Repositories the tier file does not name, and releases that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue Most-valued findings Code execution or privilege escalation crossing the platform-channel boundary from Dart into native Android or iOS code, the class that reaches the top of the $7,500 band because it turns a framework bug into device-level compromise Cross-application or cross-origin information disclosure out of framework state, the largest expected bug class here at 30% and the one that scales with Flutter's install base Access-control failures in the framework's own boundaries, such as content from one context reaching state the application intended to keep separate Memory corruption or code execution reached through image and asset decoding of attacker-supplied network content, before the application ever inspects the bytes Compromise of flutter_tools , dependency resolution or code signing, which injects into every binary built with the affected toolchain rather than into one app Exposure of the DevTools debug service or VM Service protocol in a build a developer would plausibly ship Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. flutter/flutter is Tier OT0 and caps at $7,500; flutter/devtools is Tier OT1 and caps at $3,133.70, so which repository the bug lives in changes the money Debug-mode-only behaviour that the project documents as insecure and disables in release builds is not eligible: show the bug in a release build Applications written in Flutter are not in scope; the finding has to be in the framework or its tooling Frame the report accurately: a bug in the project's own code is a product vulnerability, while compromise of the repository or release pipeline is a separate and differently priced supply-chain category Google's reward panel sets the amount at its discretion within the published band, so the tier ceiling is a maximum rather than an expectation Google's rules state that privately disclosing a flaw to a third party, for any purpose other than fixing it, will typically not qualify for a reward Disclosure Coordinated through Google Bug Hunters, which triages the report, lands the fix in the Flutter repository and publishes on its own schedule with researcher credit. Because Google treats a private disclosure to a third party as grounds for disqualification, file with Google directly, and expect a long tail after the fix ships since every downstream app has to rebuild before users are protected. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability