gVisor

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT0; supply-chain compromise is a separate category) │ $500 - $7,500 │ $625 - $8,500 Other security issue (Tier OT0 flat award) │ $1,000 │ $1,250 Submit a vulnerability CVE history 0 Last 12 months 7 Lifetime Access control 35 % Memory safety 25 % Parsing/validation 25 % Info disclosure 10 % Latest advisories Loading the feed Overview gVisor is the sandbox under Google Cloud Run, App Engine, Cloud Functions and GKE Sandbox, which makes it one of the most consequential security boundaries in commercial cloud computing, and it is fully open source, so the boundary can be read line by line. It is also used by Anthos, by several serverless-platform vendors and by AI code-execution sandboxes that need untrusted-code isolation without full VM overhead. The Sentry reimplements the Linux syscall surface in userspace Go and Netstack reimplements TCP/IP, which means a Sentry or Netstack escape is a multi-tenant cloud break rather than a library bug: the attacker starts as untrusted code someone deliberately ran and ends up on the host beside everyone else's workloads. Seven lifetime CVEs against that blast radius makes it the most underexplored top-band repository Google covers, and an OSV-only lookup misses even those, because gVisor ships security fixes as releases rather than as Go module advisories. Google pays for reports through the Open Source Software VRP at Tier OT0, where a product vulnerability runs from $500 to $7,500 and a discretionary panel decides where in that band a finding lands. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and google/gvisor is named in the published tier file at TIER_OT0: a product vulnerability anywhere in the project's own code is accepted, at $500 to $7,500 The Sentry, gVisor's userspace kernel, in full: the whole syscall implementation surface, process and thread management, signal delivery, memory management and the time and vDSO paths The platform layer that moves control between the Sentry and the host, covering systrap , KVM and ptrace The virtual filesystem and every implementation behind it: the gofer client and the LISAFS protocol, tmpfs, procfs, sysfs, overlay, and the mount and path-resolution logic above them Netstack, the pure-Go userspace network stack: link layer, ARP, IPv4 and IPv6, ICMP, UDP, TCP state handling and reassembly, and the socket layer on top runsc : the OCI runtime and container lifecycle, bundle and config handling, the seccomp filter set it generates to constrain itself, checkpoint and restore, and its control socket The gofer process, the containerd shim, and the GPU passthrough path where a sandboxed workload drives host driver interfaces Repository and release pipeline configuration, which Google prices under its separate supply-chain category Out of scope Host kernel bugs that gVisor does not mediate, which belong to the kernel rather than to the sandbox Denial of service against the sandbox itself where there is no escape and no impact on the host or other tenants Issues that require an already-privileged host operator, since that is inside the trust boundary Downstream misconfiguration of runsc by a platform operator rather than a defect in what runsc ships Third-party container runtimes that are not gVisor Memory-corruption reports submitted without exact OSS-Fuzz reproduction steps against an existing fuzz target, or a merged upstream patch Repositories in Google's GitHub orgs that the tier file does not list, which pay nothing for a product vulnerability after the April 2026 rules update Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue Most-valued findings A sandbox escape from inside a container to the host through the Sentry's syscall surface or a platform boundary: the top of the access-control class that dominates this project at 35%, and the finding the entire project is built to prevent Gofer or LISAFS protocol handling that lets a sandboxed process reach files outside the container's filesystem view, since the Gofer runs with host privileges the container is never meant to borrow Memory corruption or state confusion in Netstack driven by crafted packets from the network, which reaches the sandbox without the attacker running any code inside it A seccomp filter generation gap that leaves a host syscall reachable from the sandboxed process that the filter set was supposed to block Cross-tenant information disclosure out of Sentry or Netstack state, which on Cloud Run or GKE Sandbox means one customer's data reaching another's workload Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Memory-corruption reports need exact OSS-Fuzz reproduction steps or a merged patch before the panel will consider them The finding has to be something gVisor is supposed to mediate: host kernel bugs that gVisor never intercepts are not eligible Denial of service against the sandbox itself, with no escape and no host impact, does not qualify: the sandbox failing closed is the intended behaviour Attacks that require an already-privileged host operator sit inside the trust boundary and are not paid Frame the report accurately: a bug in the project's own code is a product vulnerability, while compromise of the repository or release pipeline is a separate and differently priced supply-chain category Google's rules state that privately disclosing a flaw to a third party, for any purpose other than fixing it, will typically not qualify for a reward Disclosure Coordinated through Google Bug Hunters, which triages the report, lands the fix in google/gvisor and publishes on its own schedule with researcher credit. gVisor ships security fixes as releases rather than as Go module advisories, so expect a release note and a CVE rather than an OSV entry. Because Google treats a private disclosure to a third party as grounds for disqualification, file with Google directly and hold the detail until the fixed release is out: an escape here is live against production cloud tenants until every operator has rolled it forward. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability