minijail

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (single vulnerability; chain bonuses need a full exploit chain) │ $5,000 - $30,000 │ $6,000 - $31,000 High │ $2,000 - $15,000 │ $2,500 - $16,000 Medium │ $500 - $1,000 │ $625 - $1,250 Any severity, at panel discretion │ $250 │ $313 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Access control 40 % Parsing/validation 25 % Memory safety 20 % Code execution 10 % Latest advisories Loading the feed Overview minijail is Google's sandboxing library and its minijail0 setuid helper: it compiles and enforces seccomp-BPF policy, sets up namespaces, drops capabilities, performs chroot and pivot_root, and applies cgroup and rlimit settings. It is the mechanism confining essentially every non-Chrome process on ChromeOS and every device model inside crosvm, which also puts it on the Android Virtualization Framework's VMM path, and it has been picked up outside Google by embedded and Android-derived projects wanting a ready-made policy compiler. Its real footprint is every Chromebook, several times per boot. A defect here behaves like a compiler miscompilation of security policy: it silently weakens confinement everywhere the library is used, without any individual caller having done anything wrong. It is also a setuid-root helper on tens of millions of devices with no public advisory stream whatsoever: NVD, OSV and the GitHub Advisory Database all return nothing, because ChromeOS handles these in the Chromium issue tracker. Google pays through the ChromeOS VRP on the same table as crosvm: $500 to $1,000 at Medium, $2,000 to $15,000 at High and $5,000 up to $30,000 for a single Critical, plus a patch bonus of up to $10,000. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The ChromeOS VRP takes any security issue affecting the ChromeOS ecosystem, and minijail is the confinement layer under essentially every non-Chrome ChromeOS process and every crosvm device. The rules name google.github.io/minijail by URL only to rule out documentation findings, which leaves code findings inside the program. One severity table applies, topping out at $30,000 for a single Critical The seccomp-BPF policy compiler in full: policy-file parsing, include handling, argument-filter expressions, and the filter program actually emitted Namespace construction across user, pid, mount, network, IPC, UTS and cgroup namespaces, together with the uid and gid map writing that decides who the confined process runs as Filesystem confinement: chroot and pivot_root , the mount table minijail builds, bind mounts and their flags, and the /proc and /dev views a jail is left holding Privilege dropping: capability sets, ambient capabilities, securebits, no_new_privs , and the order in which all of it is applied Resource limits, covering rlimit and cgroup application and whether a restriction the caller asked for is enforced on the confined process minijail0 , the command-line tool that runs setuid root and is reachable by any local user, along with the libminijail API and preload hook that callers link against Out of scope Documentation-only findings against google.github.io/minijail/, which the ChromeOS VRP rules name by URL as ineligible Issues that only manifest with the device in Developer mode LTS-channel-only findings and hardware past its auto-update expiry, both outside the supported configuration the program pays on Unreachable code paths, which the rules exclude outright: unreachable bugs do not qualify for reward Crashes a reboot recovers from, since the rules only treat a crash as a vulnerability where restart is not possible API misuse by a hypothetical caller. A badly written policy in someone else's integration is that integration's defect, and the finding has to weaken a real confinement on ChromeOS Reports filed outside bughunters.google.com with a Google Account, which the rules treat as typically not reward-eligible, and researchers in Russia or Belarus, whom sanctions screening bars from payment Most-valued findings A policy-compilation defect that emits a weaker filter than the policy asks for, the sandbox equivalent of a miscompilation. It degrades confinement everywhere minijail is used with no caller at fault, and it is the clearest route to the $30,000 Critical row Escaping the minijail wrapped around a crosvm device process onto the host, the second half of every VM escape on ChromeOS and what makes a device-model bug a full compromise Local privilege escalation through minijail0 from an ordinary user to root, the classic setuid-helper shape and the middle of the 40% access-control slice Namespace or pivot_root handling that leaves a mount, a capability or a filesystem view reachable inside a jail that was supposed to have dropped it Parsing bugs in policy or argument handling where malformed input silently changes the resulting confinement instead of failing closed, the most dangerous possible failure mode for a sandbox Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Reproduce on a Chromebook or ChromeOS Flex device on supported hardware, running the latest Stable, Beta or Developer channel build in verified mode Because minijail is a library, the finding has to weaken a real confinement on ChromeOS: a hypothetical caller misusing the API is not a vulnerability in minijail Documentation findings against google.github.io/minijail are named in the rules as explicitly not rewardable Submit through bughunters.google.com with a Google Account: the chromeos-security mailing list is accepted but submissions through it are typically not reward-eligible Developer-mode-only issues and unreachable bugs do not qualify, and the rules state plainly that unreachable bugs do not qualify for reward Sanctions screening applies, and no rewards are issued to individuals in Russia or Belarus Disclosure Coordinated with Google, on Google's clock, under the same ChromeOS VRP process as crosvm: bugs go public 14 weeks after the fix ships, with a documented appeals path through [email protected] . Because the rules exclude anything disclosed to a third party for purposes other than fixing it, file with Google directly first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability