Microsoft Bounty Program
By Microsoft Bug bounty on Self-hosted microsoft.com
Accepting reports
Full safe harbor
- Top reward
- $250,000
- Top severity paid
- Not published
- Assets in scope
- 11
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $250,000
- top reward.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$250,000
Earn up to $250,000 USD in bug bounty awards
- Safe harbor
-
Full
Microsoft Bounty Legal Safe Harbor
- Hall of fame
-
Yes
Learn more about the Researcher Recognition Program, including the Bounty Leaderboard, Special Mentions, and CVEs.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test.
Domains 11
- live.com
- live.net
- lync.com
- microsoft.com
- office365.com
- office.com
- onedrive.com
- sharepoint.com
- skype.com
- sway.com
- yammer.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Microsoft Bounty Program's policy. "We" in these lines means the program, not this site.
While testing
-
Do not access, modify, or exfiltrate customer data.
-
Never disrupt services or compromise uptime.
-
If you encounter sensitive information or are unsure whether an action is safe, stop immediately and contact us.
-
Report vulnerabilities privately and allow time for remediation before public disclosure.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-124194 | Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. | Medium 6.5 | 10 Nov 2026 |
| CVE-2026-121162 | UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | Medium 5.4 | 3 Nov 2026 |
| CVE-2026-121034 | Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Critical 9.6 | 3 Nov 2026 |
| CVE-2026-121037 | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Critical 9.6 | 3 Nov 2026 |
| CVE-2026-69446 | Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. | Medium 4.4 | 30 Oct 2026 |
| CVE-2026-96199 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | High 8.8 | 29 Oct 2026 |
| CVE-2026-96203 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | High 8.8 | 29 Oct 2026 |
| CVE-2026-96198 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | High 8.8 | 29 Oct 2026 |
| CVE-2026-96187 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | High 7.4 | 29 Oct 2026 |
| CVE-2026-96192 | Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network. | High 8.8 | 29 Oct 2026 |
| CVE-2026-96196 | Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. | High 8.8 | 29 Oct 2026 |
| CVE-2026-88090 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | Medium 5.4 | 29 Oct 2026 |
| CVE-2026-88077 | Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | High 8.8 | 29 Oct 2026 |
| CVE-2026-88078 | Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | Medium 4.3 | 29 Oct 2026 |
| CVE-2026-85890 | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | High 8.8 | 29 Oct 2026 |
| CVE-2026-85897 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | High 8.8 | 29 Oct 2026 |
| CVE-2026-85899 | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network. | High 8.1 | 29 Oct 2026 |
| CVE-2026-85330 | Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. | Medium 4.3 | 29 Oct 2026 |
| CVE-2026-20942 | Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | Medium 4.3 | 29 Oct 2026 |
| CVE-2026-118330 | Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | High 8.8 | 27 Oct 2026 |
| CVE-2026-118310 | Use after free in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Critical 9.6 | 27 Oct 2026 |
| CVE-2026-62765 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | High 7.5 | 27 Oct 2026 |
| CVE-2026-85898 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | High 8.8 | 27 Oct 2026 |
| CVE-2026-83831 | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | High 8.8 | 27 Oct 2026 |
| CVE-2026-111497 | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie | Critical 9.2 | 22 Oct 2026 |
| CVE-2026-96644 | Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using the original full dimensions. A crafted wide, short metafile can pass the pixel-count decompression-bom | High 7.1 | 21 Oct 2026 |
| CVE-2026-113340 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Medium 6.5 | 20 Oct 2026 |
| CVE-2026-113334 | Buffer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | High 8.8 | 20 Oct 2026 |
| CVE-2026-113326 | Improper input validation in Core in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Medium 6.5 | 20 Oct 2026 |
| CVE-2026-113295 | Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Medium 6.5 | 20 Oct 2026 |
| CVE-2026-113293 | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | High 8.8 | 20 Oct 2026 |
| CVE-2026-113283 | Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code outside the sandbox via physical access. (Chromium security severity: Medium) | Critical 9.6 | 20 Oct 2026 |
| CVE-2026-113285 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | High 8.8 | 20 Oct 2026 |
| CVE-2026-113252 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Critical 9.6 | 20 Oct 2026 |
| CVE-2026-113242 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | High 8.8 | 20 Oct 2026 |
| CVE-2026-113210 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | High 8.8 | 20 Oct 2026 |
| CVE-2026-113157 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Medium 6.5 | 20 Oct 2026 |
| CVE-2026-113134 | Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | High 8.8 | 20 Oct 2026 |
| CVE-2026-113119 | Improper certificate validation in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: High) | High 8.8 | 20 Oct 2026 |
| CVE-2026-113082 | Integer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Medium 6.5 | 20 Oct 2026 |
| CVE-2026-113074 | Incorrect authorization in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | High 8.8 | 20 Oct 2026 |
| CVE-2026-113011 | Incorrect authorization in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium) | High 8.8 | 20 Oct 2026 |
| CVE-2026-108449 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108450 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108451 | Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108452 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108453 | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Medium 6.5 | 15 Oct 2026 |
| CVE-2026-108454 | Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Medium 6.5 | 15 Oct 2026 |
| CVE-2026-108455 | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Medium 6.5 | 15 Oct 2026 |
| CVE-2026-108441 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108442 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108443 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108444 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108445 | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108446 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108447 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108448 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | High 7.5 | 15 Oct 2026 |
| CVE-2026-108438 | Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Medium 6.5 | 15 Oct 2026 |
| CVE-2026-108439 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |
| CVE-2026-108440 | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | High 8.8 | 15 Oct 2026 |