OpenHarmony

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz 严重 / Critical (published maximum; the working group sets the actual amount) │ CNY 1,000,000 │ CNY 1,000,000 高危 / High (published maximum) │ CNY 500,000 │ CNY 500,000 中危 / Medium (published maximum) │ CNY 200,000 │ CNY 200,000 低危 / Low (published maximum) │ CNY 10,000 │ CNY 10,000 Submit a vulnerability CVE history 27 Last 12 months 177 Lifetime Latest advisories Loading the feed Overview OpenHarmony is the OpenAtom Foundation's open-source operating system, the upstream from which Huawei's HarmonyOS is built, and it is designed to scale from mini-system microcontrollers through small-system devices to the full standard system on phones, tablets and other consumer hardware. The bounty programme's scope is the OS source itself: the system service layer, the framework layer and the application layer of the OpenHarmony technical architecture, plus mini-system hardware devices, with the tree at atomgit.com/openharmony named as the definitive reference. That places the programme's own trusted computing base squarely in scope, which is what its top band is priced for: remote arbitrary code execution in the TCB and cross-device remote code execution are the published Critical examples, and the ladder runs down through screen-lock bypass and app-data isolation failures at High to information disclosure at Low. The programme publishes maxima only: CNY 1,000,000, CNY 500,000, CNY 200,000 and CNY 10,000 across its four levels, with the Security Response Working Group setting the actual figure from report detail, attack path: zero-click, one-click or local; exploit stability, and whether the bug reproduces on the latest LTS. Those figures are yuan and are deliberately not converted here. In scope The OpenHarmony technical architecture as the programme states it: the system service layer, the framework layer and the application layer, across both the standard system and the small system, plus mini-system hardware devices. The programme names the tree at atomgit.com/openharmony as the definitive boundary of what counts as OpenHarmony code The system service layer in full, including the distributed soft bus and distributed data management that let devices find and trust each other, the ability and bundle managers that install and launch applications, and the security subsystem that issues access tokens and holds keys The framework layer in full: ArkUI, the ArkTS runtime and compiler, and the JavaScript and native APIs applications call into The application layer, meaning the system applications the OS ships and the boundaries they hold against installed third-party apps Mini-system hardware devices and the driver framework beneath them, which the scope statement names alongside the standard and small systems Out of scope Vulnerabilities that do not affect OpenHarmony specifically, which the programme names as protocols and third-party open source the community carries and redirects to the corresponding upstream channel The Linux kernel code the OS bundles at its kernel layer, which belongs to that upstream and sits outside the three architecture layers the scope statement names Anything outside the tree at atomgit.com/openharmony, which the scope statement makes the boundary Findings the Security Response Working Group grades below 低危 / Low, since the published ladder prices nothing beneath it Reports from anyone unwilling or unable to complete identity verification, which the platform requires before it will pay Most-valued findings Remote arbitrary code execution in the trusted computing base, the programme's own Critical example and the class its CNY 1,000,000 band is priced for. Code running inside the TCB defeats every boundary above it at once Cross-device remote code execution, the other published Critical example and the distinctive risk of a distributed OS: OpenHarmony's premise is devices trusting each other over a soft bus, so a bug that hops that trust reaches hardware the attacker never touched Local arbitrary code execution in the trusted computing base, published as a High example at CNY 500,000 Screen-lock bypass on a device, the programme's other published High example and the most demonstrable of them on hardware you physically hold Remote arbitrary code execution in a restricted process, published as the Medium example at CNY 200,000, where the win is reaching execution at all rather than reaching it privileged Anything that reproduces on the latest LTS with a stable, low-interaction attack path, because the working group prices exactly those properties. A zero-click chain with a reliable proof of concept is what moves a finding to the top of its band Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Reports must include the affected component versions, an issue description with code analysis, complete reproduction steps, and a working proof of concept with compilable source, its dependencies and build instructions; fix or mitigation code is optional Only the maxima are published. The Security Response Working Group sets the actual amount from the detail of the report, the attack path (zero-click, one-click or local), how stable the exploit is, and whether it reproduces on the latest LTS Severity is graded on OpenHarmony's own four-level single-device scale, 严重, 高危, 中危, 低危, rather than on CVSS, so argue impact in the programme's terms rather than in a CVSS vector Duplicates pay only the first reporter, and a vulnerability that was already disclosed is ineligible Vulnerabilities that are not specific to OpenHarmony, protocols and third-party open-source software the community merely carries, are redirected to the corresponding upstream channel rather than paid here The live rules page is version 4.0 dated 2026-07-16 and exists only in Chinese; the English text mirrored in git is version 1.0 from 2023 with identical CNY figures, and the platform requires identity verification, so read the current Chinese page before you commit to a submission Disclosure Reports go privately to the OpenHarmony Security Response Working Group, the published process routes them to the programme's own address under PGP encryption, and the group decides both the grade and the timing. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability