FreeType

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Chrome VRP: a controlled write in the browser, network or GPU process reached from web contents (the x10 rung, and the ceiling a single font-library report reaches) │ $5,000 │ $6,000 Chrome VRP: an ASAN write or use-after-free in those processes from web contents, or a controlled read (x5) │ $2,500 │ $3,125 Chrome VRP: an ASAN read in those processes from web contents (x2) │ $1,000 │ $1,250 Chrome VRP: memory corruption confined to a sandboxed renderer, ASAN write or use-after-free (x2) │ $1,000 │ $1,250 Chrome VRP: base reward for a below-baseline report, a mitigated issue, or where no harness exists (x1) │ $500 │ $625 Mozilla, filed separately: a sec-high rating (High Impact) with a high-quality report; $3,000 baseline │ $5,000 │ $6,000 Submit a vulnerability CVE history 2 Last 12 months 96 Lifetime Memory safety 78 % Parsing/validation 14 % Denial of service 5 % Latest advisories Loading the feed Overview FreeType is the font rasteriser for the non-Apple, non-Microsoft world and a good deal of the rest: every Android handset, ChromeOS, essentially every Linux desktop and server that draws a glyph, Chrome and Firefox on Linux and Android, apps that bundle it, game engines, embedded and automotive HMIs, and PDF and document pipelines. Its whole job is turning attacker-supplied binary font data into memory writes, and it is one of the few libraries here with a recent confirmed exploited-in-the-wild entry: CVE-2025-27363, an out-of-bounds write in the CFF/Type1 charstring path. When it breaks, it breaks everywhere at once. The project itself runs no bounty; the money is entirely downstream, and two funders pay independently for the same bug: Google through the Chrome VRP and Mozilla through its Bugzilla client bounty, each topping out around $5,000 for a font-library memory-safety report. sorona.xyz adds 1.25× on top of whatever they award, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Both funders take FreeType as a third-party component of a browser they ship. Mozilla pays for vulnerabilities in libraries vendored into its shipped client, where FreeType sits at modules/freetype2, and Chrome's VRP invites bugs in the third-party components it ships or uses. The core of the library: the object, stream and memory layers, the cache subsystem, and the SFNT table loader TrueType outline parsing over glyf, loca, hmtx, cmap and kern, and the TrueType bytecode interpreter CFF, CFF2, Type 1, Type 42 and CID-keyed font handling, charstring interpretation included OpenType variations: fvar, gvar and avar, and the variable-font instancing machinery Bitmap and colour formats: sbix, CBDT/CBLC, EBDT/EBLC, COLR/CPAL and embedded PNG glyphs The legacy drivers FreeType still ships: BDF, PCF, PFR, Windows FNT and the Type 1 path The auto-hinter, the smooth and monochrome rasterisers, and the outline and span code beneath them WOFF and WOFF2 decompression as reached from an @font-face rule Out of scope Rendering-quality and hinting-accuracy bugs, which are correctness complaints rather than security findings Anything only reachable through a standalone fuzz harness with no browser path Pure denial of service that merely crashes the browser, which Mozilla excludes in terms Code neither browser ships, and features not enabled in a shipping build Patch gaps: pointing out an upstream fix that has not yet landed in a vendored copy Bugs in a distribution's system FreeType that you cannot show either browser reaching Most-valued findings A controlled out-of-bounds write in the CFF/Type1 charstring interpreter reached from a web font. That is the x10 rung at $5,000 and the exact shape of CVE-2025-27363. Heap corruption in TrueType table parsing or the bytecode interpreter driven purely by attacker-supplied font bytes; memory safety is 78% of FreeType's CVE history A use-after-free or out-of-bounds write that lands in the browser, network or GPU process rather than in a sandboxed renderer: that distinction is what separates $5,000 from $500 Bugs in WOFF2 decompression, since the whole path runs before a single glyph is drawn and is reachable from one @font-face rule Memory disclosure that returns heap or rasterised contents to script, which pays on Mozilla's information-disclosure row as well as on Chrome's read primitives Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Google requires you to report the bug upstream to the FreeType maintainers in parallel; bugs not reported upstream may not be eligible for a full reward Show the browser path. The bug has to be reachable through a downloadable web font or a system-font path the browser actually exercises, not only through a standalone fuzz harness On Linux, Chrome and Firefox commonly link the system FreeType rather than a bundled copy, so name the browser build you demonstrated on Mozilla will not pay for a patch gap: an issue already fixed upstream in a library it vendors on a regular cadence does not qualify Mozilla's sec-high gate and its seven-day internal-tooling window apply on that side Google treats a bug disclosed to a third party for any purpose other than fixing it as ineligible, so file with the program first Disclosure Coordinated with whichever funder you file with, and with the FreeType maintainers upstream: Google's rules require that parallel upstream report. Both browsers ship the fix on their own release trains and publish advisories with researcher credit. Because Google's terms treat prior third-party disclosure as disqualifying, hold everything until the fix is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability