JAX and OpenXLA

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Memory safety 40 % Denial of service 25 % Parsing/validation 25 % Code execution 8 % Latest advisories Loading the feed Overview JAX is the array and autodiff framework Google DeepMind trains on, and OpenXLA is the compiler backend underneath JAX, TensorFlow and PyTorch/XLA on both TPUs and GPUs. The footprint is concentrated rather than broad: comparatively few installs, but those installs are large-scale training and inference clusters, and XLA in particular is shared infrastructure across all three major ML frameworks, so a compiler-level flaw reaches far past JAX's own user base. Neither repository has a single recorded CVE across its whole history, which against a codebase this large and this new reads as an unaudited surface rather than a safe one. Google pays for reports here through the Open Source Software VRP at Tier OT1, where a product vulnerability runs from $101 to $3,133.70 and a discretionary panel decides where in that band a finding lands. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and it names both jax-ml/jax and openxla/xla at TIER_OT1: a product vulnerability anywhere in either repository is accepted, at $101 to $3,133.70 JAX's public array surface and the tracing layer beneath it: jax.numpy , jax.lax , jax.scipy , random number generation, and the shape and dtype inference that runs behind all of them The transformations and the jaxpr representation they build and consume: jit , grad , vmap , pmap and shard_map , together with sharding and device placement Serialisation and export: jax.export and jax.experimental.serialize , the StableHLO artifacts they emit, and the loader that turns one back into an executable computation Pallas kernels, the foreign-function interface and custom-call registration, plus jaxlib , the native extension carrying them down into XLA XLA's front end: HLO and StableHLO text and proto parsing, the whole optimisation and layout pass pipeline, and code generation for the CPU, GPU and TPU backends The PJRT runtime and its plugin interface: device memory management, buffer donation, executable caching, and the collectives used across devices The distributed coordination service that multi-host jobs speak between cluster nodes, and the repository and release pipelines behind the published wheels, which Google prices under its separate supply-chain category Out of scope Numerical accuracy differences with no security consequence, which are correctness bugs rather than vulnerabilities Compiling or executing code the caller already controls, since that sits inside the trust boundary the framework assumes GPU vendor driver and CUDA bugs that merely surface through XLA and belong to the hardware vendor Model-behaviour and ML-safety research, which the program routes to the Google AI VRP rather than the OSS VRP Memory-corruption reports in XLA submitted without exact OSS-Fuzz reproduction steps against an existing fuzz target, or a merged upstream patch Any other repository in the jax-ml , openxla or Google orgs that the tier file does not list, which pays nothing for a product vulnerability after the April 2026 rules update Defects that only reproduce on a release the projects no longer ship, since the program covers the latest versions Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue Most-valued findings Memory corruption in XLA's HLO parser or optimisation passes driven by an adversarial graph, the largest expected bug class here at 40% and the one the compiler's shared position under three frameworks makes most valuable Deserialisation of an exported JAX function that reaches code execution in the process loading it, since exported artifacts move between machines and between organisations Use-after-free or double-free on donated device buffers in PJRT, where the framework transfers ownership of memory across an API boundary and the caller can still reach it Anything in the multi-host coordination service reachable from another node on the training network, because one compromised worker then reaches the whole cluster A compiler-level flaw that reproduces through TensorFlow or PyTorch/XLA as well as JAX, since XLA is the shared backend for all three and the blast radius multiplies accordingly Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Memory-corruption reports in XLA need exact OSS-Fuzz reproduction steps or a merged patch before the panel will consider them Model-behaviour and ML-safety findings belong to the Google AI VRP, and the OSS VRP may route your report there instead of paying it here Only jax-ml/jax and openxla/xla are in scope; both sit at Tier OT1 in Google's published repository tier file Frame the report accurately: a bug in the project's own code is a product vulnerability, while compromise of the repository or release pipeline is a separate and differently priced supply-chain category Google's reward panel sets the amount at its discretion within the published band, so the tier ceiling is a maximum rather than an expectation Google's rules state that privately disclosing a flaw to a third party, for any purpose other than fixing it, will typically not qualify for a reward Disclosure Coordinated through Google Bug Hunters, which triages the report, drives the fix upstream in the JAX or XLA repository and publishes on its own schedule with researcher credit. Because Google treats a private disclosure to a third party as grounds for disqualification, file with Google directly and hold the detail until the fix has shipped. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability