JavaScriptCore

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Browser attack, Web Content code execution (the only row JavaScriptCore reaches on its own; the sandbox-escape and kernel rows sit outside this engine) │ $10,000 │ $11,000 Submit a vulnerability CVE history 78 Last 12 months 329 Lifetime Memory safety 55 % Code execution 25 % Parsing/validation 10 % Info disclosure 5 % Latest advisories Loading the feed Overview JavaScriptCore is one of the three production JavaScript engines, and the one with the least substitutability: it is the only engine legally shippable inside WKWebView, so every in-app browser on iOS runs it, it powers JS execution in macOS system components through JavaScriptCore.framework, and it is the engine behind Bun's execution on the server side. It is also where almost all of Safari's recent CVE volume actually sits, 78 of the 111 Safari CVEs published in the last twelve months match the engine signature Apple uses in its advisory text. Apple pays for it under the same Security Bounty as the rest of WebKit, but the reachable money is different and much smaller than the programme's headline: JavaScriptCore runs inside the WebContent process and nowhere else, so the only row a JSC bug reaches on its own is Web Content code execution at $10,000. Getting to the $300,000 sandbox-escape row or the $1,000,000 kernel row means chaining into code that is not in this engine. sorona.xyz adds 1.25× on top of whatever Apple awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding, which is worth reading twice here, because chaining is exactly what raises a JSC finding above its own tier. In scope Apple's declaration is outcome-based: the Security Bounty covers research across all Apple products and public-facing services, and the JavaScript engine running inside Safari's WebContent process is Source/JavaScriptCore in the open WebKit tree. A defect anywhere in that engine that a shipping Apple platform reaches is covered, priced at the Web Content code execution row of $10,000 The full compilation pipeline as it ships: the parser and bytecode generator, the LLInt interpreter, the Baseline compiler, and the DFG and FTL/B3 optimising tiers The runtime and object model: structures and structure IDs, property storage, inline caches and prototype chains, together with the gigacage and Structure ID randomisation mitigations that harden them The Riptide garbage collector and the allocators beneath it, including finalisation and the weak-reference machinery The builtins and the standard library the engine implements: Array, Object, Proxy and Reflect, Map and Set, Date, Intl, Promises and the microtask queue, and module loading Typed arrays, ArrayBuffer and SharedArrayBuffer, DataView, and the JSON parser and serialiser The YARR regular-expression engine and the WebAssembly path, covering module parsing, validation and the BBQ and OMG compilation tiers The embedder surfaces Apple ships on top of the engine: the JavaScriptCore C and Objective-C APIs in JavaScriptCore.framework, and the engine as it executes inside WKWebView Out of scope Standalone jsc shell crashes that do not manifest through Safari. The shell is a development binary rather than a shipping Apple platform Bugs only present in non-Apple WebKit ports such as WebKitGTK or WPE Apple Pay, non-public-facing Apple systems, and third-party services Unshipped trunk code, since Apple pays for the effect on a released platform rather than for the state of the tree Reports without a captured Target Flag, which do not reach the stated reward even when the bug itself is real Submissions barred on eligibility rather than on merit: sanctions screening applies, an 18-month bar runs on former Apple employees, and an award lapses if it is not accepted within a year of being offered Most-valued findings JIT type confusion in the DFG or FTL/B3 tiers that yields an arbitrary read and write inside the WebContent process. This is what the $10,000 Web Content code execution row exists for and the shape most paid JSC findings take. Bypasses of the gigacage or Structure ID randomisation. Those mitigations are what currently stand between a memory-safety bug and a reliable exploit, and they are the frontier Apple's own advisory history keeps returning to Use-after-free in the Riptide collector, where collection races mutator state. Memory safety is 55% of this engine's expected class mix and the GC is a persistent source of it WebAssembly compilation bugs in the BBQ and OMG tiers, which reach the same primitives through a surface carrying less accumulated hardening than the JS JIT ArrayBuffer detachment races and typed-array bounds confusion, the classic route from a pure JavaScript trick to out-of-bounds memory with no native code involved Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Demonstrate the bug against shipping Safari. A crash in the standalone jsc shell that you cannot drive through the browser is not a bounty-eligible finding Capture the Target Flag: Apple gates the headline amounts on it, so a report without one does not reach the stated figure Tell nobody but Apple until Apple has released the software update and published the advisory: that is the eligibility condition, not a disclosure preference Sanctions screening applies, an 18-month bar runs on former Apple employees, and an award has to be accepted within a year of being offered Size your effort against $10,000, not against the programme's million-dollar headline. Those rows are sandbox-escape and kernel outcomes and neither lives in JavaScriptCore Disclosure Apple runs it end to end and credits external JSC researchers in nearly every Safari advisory, but the advisory ships with the OS release that carries the fix and the timetable is Apple's. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability