Hermes

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 20 Lifetime Memory safety 55 % Code execution 20 % Denial of service 15 % Parsing/validation 5 % Latest advisories Loading the feed Overview Hermes has been the default JavaScript engine for React Native since 0.70, which makes it the interpreter inside a very large share of the cross-platform mobile apps shipping today, Meta's own among them. Its twenty CVEs are concentrated in a 2022-to-2023 cluster ending at CVE-2023-30470 and are overwhelmingly memory corruption in the bytecode interpreter and the JavaScript parser; the quiet since then reflects a concentrated audit that ended rather than a surface that closed. Hermes is also the unusual case in this program where an open-source repository is directly load-bearing inside the flagship apps Meta prices at full multiplier, so a Hermes defect demonstrated as code execution in a Meta app is one of the few open-source findings here with a credible path past the 0.5× non-flagship discount. Meta pays cash on its own bug bounty with a published minimum of $500; it sets severity, and it publishes no payout guideline covering open source, so no maximum is stated in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/hermes sits under the first, so the repository is in scope in full. It carries no SECURITY.md of its own and inherits the facebook/.github one, which names the same program. The row sets no severity cap and Meta publishes no payout guideline covering open source The bytecode interpreter and the object model beneath it: property storage, hidden classes and the inline caches The JavaScript front end, meaning the lexer, the parser, semantic validation and the ahead-of-time compiler that emits Hermes bytecode The bytecode format and its loader, covering header and version checks, table validation and how a .hbc file is mapped in The garbage collector, Hades included, with rooting, write barriers and object lifetime Builtins and the standard library: String , Array , JSON , Proxy , the Intl support and the regular-expression engine The JSI boundary, host objects and host functions, where JavaScript crosses into native code the embedding app trusts The debugger and the inspector protocol implementation, plus the hermesc compiler and the standalone VM the repository ships Out of scope Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list React Native itself, for that reason. It now lives in the react/ org, so a defect there is unpayable under this program however directly it touches Hermes Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, since that is what Meta scores a report on Duplicates. Meta pays the first reporter only Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions Bugs in an application that embeds Hermes where the defect is that application's own JavaScript or native code Crashes with no demonstrated memory-safety or control-flow consequence, a bare assertion failure or an out-of-memory abort among them Most-valued findings Memory corruption in the bytecode interpreter driven by attacker-supplied JavaScript. That is 55% of Hermes's recorded history and the most direct route to the code-execution rung Meta prices at the top of its band Type confusion or an interpreter invariant violation that yields a controlled read or write, the standard first half of an engine exploit chain A malformed .hbc bytecode file that corrupts memory in the loader, which matters wherever an app loads bundles it did not compile itself A Hermes defect demonstrated as remote code execution inside a Meta app, the one open-source path in this program with a credible claim past the 0.5× non-flagship multiplier Garbage-collector lifetime bugs a script steers deterministically, as against a flaky crash a fuzzer surfaced The twenty CVEs on record cluster in 2022 and 2023 and stop at CVE-2023-30470, overwhelmingly in the interpreter and the parser. Read the quiet since as an audit that ended rather than a surface that closed Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems; a Hermes bug demonstrated inside a shipping Meta app is worth materially more than the same bug shown only in a test harness Only repositories under https://github.com/facebook/ and https://github.com/facebookincubator/ are eligible; facebook/hermes qualifies under the first, but React Native itself has moved to the react/ org and no longer matches either prefix Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Because that clause reaches private transfer as well as publication, file with Meta directly first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability