HarfBuzz

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Chrome VRP: a controlled write in the browser, network or GPU process reached from web contents (the x10 rung, and the ceiling a single font-library report reaches) │ $5,000 │ $6,000 Chrome VRP: an ASAN write or use-after-free in those processes from web contents, or a controlled read (x5) │ $2,500 │ $3,125 Chrome VRP: an ASAN read in those processes from web contents (x2) │ $1,000 │ $1,250 Chrome VRP: memory corruption confined to a sandboxed renderer, ASAN write or use-after-free (x2) │ $1,000 │ $1,250 Chrome VRP: base reward for a below-baseline report, a mitigated issue, or where no harness exists (x1) │ $500 │ $625 Mozilla, filed separately: a sec-high rating (High Impact) with a high-quality report; $3,000 baseline │ $5,000 │ $6,000 Submit a vulnerability CVE history 1 Last 12 months 8 Lifetime Memory safety 70 % Parsing/validation 20 % Denial of service 8 % Latest advisories Loading the feed Overview HarfBuzz shapes text for essentially the entire computing world: Chrome, Firefox and Safari; Android and ChromeOS; every GNOME and KDE desktop through Pango and Qt; LibreOffice; Java via OpenJDK; Flutter, Godot, Unity, matplotlib and the modern TeX engines. If software renders non-Latin script correctly, it is probably running HarfBuzz: its own copyright header names Google, Facebook, Mozilla, SIL and Nokia. The attack surface is close to the worst case for memory safety: a set of per-script state machines driven directly by attacker-supplied font binaries, reached from any page that serves a web font. Its published CVE count is small, eight over its life, but eleven Chrome CVEs name the Fonts component that HarfBuzz sits in. The project runs no bounty of its own; two downstream funders pay independently for the same bug: Google through the Chrome VRP and Mozilla through its Bugzilla client bounty; each topping out around $5,000 for a shaping-library memory-safety report. sorona.xyz adds 1.25× on top of whatever they award, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Both funders take HarfBuzz as a third-party component of a browser they ship. Mozilla pays for vulnerabilities in libraries vendored into its shipped client, and Chrome's VRP invites bugs in the third-party components it ships or uses, naming PDFium and Skia as examples. Font table parsing across OpenType and TrueType: GSUB, GPOS, GDEF, cmap, glyf, CFF and CFF2, name and kern, with the blob and sanitising layers underneath them The shaping pipeline itself: normalisation, the Unicode and script property tables, buffer management, cluster handling and the fallback shaper The per-script shapers, each a distinct state machine over attacker-controlled font data: Arabic, Indic, Khmer, Myanmar, Hebrew, Thai, Hangul, Tibetan and the universal shaping engine AAT shaping over the Apple layout tables, morx and kerx included Variable-font instancing and the fvar and avar axis machinery hb-subset, the subsetting API, along with the hb-draw and hb-paint outline and colour-glyph extraction surface HarfBuzz as shipped inside Chrome, and as vendored into the Firefox tree at gfx/harfbuzz, reached through a web font or a real text run Out of scope Anything only reachable through a standalone hb-shape harness with no browser path Rendering incorrectness with no memory-safety or disclosure consequence Chrome's rule against unshipped features and Mozilla's rule against paying for a browser crash alone both apply here Patch gaps: a bug already fixed upstream and merely not yet vendored into a browser build Bugs that live in a consumer's use of HarfBuzz (Pango, Qt, Skia) rather than in HarfBuzz itself Most-valued findings A controlled out-of-bounds write in table parsing or a shaping state machine, reached from a web font in a browser, network or GPU process. That is the x10 rung at $5,000. Use-after-free in the shaping engines while buffers are reallocated mid-run, the dominant shape of the 70% of HarfBuzz findings that are memory-safety bugs Bugs in the complex-script shapers, Indic, Khmer, Myanmar, the universal engine, which carry the most state and the least fuzzing coverage per branch Variable-font instancing flaws, where fvar and avar axis values taken straight from the font drive the geometry arithmetic Memory corruption in hb-subset, since subsetting increasingly runs server-side on uploaded fonts and turns a font-service backend into the target rather than a browser tab Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Google requires you to report the bug upstream to the HarfBuzz maintainers in parallel; bugs not reported upstream may not be eligible for a full reward The bug has to be reachable through the browser, a web font or a real text run, not only through a standalone hb-shape fuzz harness Mozilla's sec-high gate and its seven-day internal-fuzzing window apply on that side Mozilla will not pay for a patch gap: an issue already fixed upstream in a library it vendors on a regular cadence does not qualify HarfBuzz itself pays nothing; both pathways are downstream consumers, and each funder will pay for the same bug independently Google treats a bug disclosed to a third party for any purpose other than fixing it as ineligible, so file with the program first Disclosure Coordinated with whichever funder you file with, and with the HarfBuzz maintainers upstream: Google's rules require that parallel upstream report. The maintainers fix in the open on GitHub, and both browsers then ship it on their own release trains with advisory credit. Because Google's terms treat prior third-party disclosure as disqualifying, hold the detail until the fix is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability