libwebp

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Memory corruption from web contents, controlled write in the browser, network or GPU process (this project's ceiling; the $250,000 full-chain rungs need a complete Chromium exploit) │ $5,000 │ $6,000 Memory corruption from web contents, ASAN write or use-after-free │ $2,500 │ $3,125 Memory corruption from web contents, controlled read │ $2,500 │ $3,125 Memory corruption from web contents, ASAN read │ $1,000 │ $1,250 Base reward (below-baseline report, mitigated issue, or no harness available) │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 15 Lifetime Memory safety 80 % Parsing/validation 12 % Denial of service 6 % Latest advisories Loading the feed Overview libwebp is the canonical demonstration that a small image codec can become a global emergency. CVE-2023-4863, a heap overflow in its lossless Huffman decoder, was exploited in the wild and forced coordinated emergency patches across Chrome, Firefox, Safari, Edge, Android, iOS, Electron and effectively every application that had ever vendored the library, because by then WebP support had been absorbed into browsers, operating systems, messaging apps, image pipelines and CDN transcoders. The library ships inside Chrome, Firefox, Safari, Android, iOS, Electron, ImageMagick, Pillow, GD, Qt, GTK and the image layer of most CMSes. Fifteen lifetime CVEs is a small number attached to an enormous blast radius, which is exactly the profile a bounty rail is worth pointing at. Two funders pay independently: Google under the Chrome VRP, where a controlled write reached by decoding an image from web contents tops the standard table at $5,000 against a $500 base, and Mozilla for the copy vendored into Firefox at media/libwebp, where a sec-high rating also reaches $5,000. One memory-safety bug can therefore be filed to two programs, each paying for the impact on its own product. sorona.xyz adds 1.25× on top of whatever is awarded, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google takes any High or Critical severity bug in Chrome Browser and extends that to the third-party components it ships or uses, which covers libwebp Mozilla pays separately under its own line on third-party libraries incorporated into shipped client code, and libwebp is present in the Firefox tree at media/libwebp The lossless VP8L decoder, including Huffman table construction and the colour-cache and predictor transforms The lossy VP8 decoder and its bitstream parser, driven entirely by attacker-supplied bytes The container and RIFF chunk parser that sizes everything downstream of it The demuxer, the mux library and animated WebP frame assembly, covering ANMF and ANIM handling and the WebPAnimDecoder API Alpha-channel decoding and the filtering applied to the alpha plane libsharpyuv and the colour-conversion and rescaling helpers shipped alongside the decoder Out of scope Encoder-only bugs with no decode path from untrusted input, since nobody feeds an attacker's bytes to the encoder Bugs that actually live in a downstream wrapper such as ImageMagick, Pillow, GD or a language binding, rather than in libwebp itself Reports filed to the Google OSS VRP instead of the Chrome VRP, where libwebp's absence from the tier file means a product vulnerability pays nothing Experimental features, debugging features and unsafe browser flags, per the Chrome VRP's standard exclusions Code on trunk less than seven days old, which has not reached any shipping channel Speculative reports that do not demonstrate the bug manifesting in a shipping browser Most-valued findings A heap write in the VP8L lossless decoder reachable from an ordinary image tag. That is the CVE-2023-4863 shape, and the only class that reliably reaches the $5,000 controlled-write rung Out-of-bounds reads or use-after-free in the VP8 bitstream parser triggered purely by a malformed file, with no user interaction beyond loading a page Frame-assembly confusion in animated WebP, where the demuxer and the frame loop disagree about buffer geometry across frames Integer overflow in the RIFF chunk parser or in dimension arithmetic that yields an undersized allocation the decoder then fills Alpha-plane and filtering defects, historically a productive source of size-arithmetic errors in this codebase Any of the above that also reproduces in the copy Firefox vendors at media/libwebp, since that earns a second, independent award from Mozilla for the same work Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File to the Chrome VRP, not the Google OSS VRP: libwebp is absent from the OSS VRP tier file, so a report filed there lands in OT2 and pays nothing for a product vulnerability The bug must be reachable by decoding an image from a web page, which is the default path in both Chrome and Firefox: a pure encoder path is not it The bug must manifest in an active Stable, Beta or Dev channel on the latest operating system and 64-bit hardware, and code less than seven days old on trunk is excluded The GitHub repository is a read-only mirror that does not accept pull requests, so upstream here means the Chromium tracker The Mozilla leg is a separate filing to Mozilla's Bugzilla under its clause on third-party libraries incorporated into shipped client code, and Mozilla's patch-gap exclusion applies to that leg Disclosure Coordinated through the Chromium issue tracker, where reports are made public 14 weeks after being marked as fixed, and separately through Mozilla's Bugzilla for the vendored copy. Hold the detail until the program confirms a fix has shipped and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability