PDFium

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Memory corruption from web contents, controlled write in the browser, network or GPU process (this project's ceiling; the $250,000 full-chain rungs need a complete Chromium exploit) │ $5,000 │ $6,000 Memory corruption from web contents, ASAN write or use-after-free │ $2,500 │ $3,125 Memory corruption from web contents, controlled read │ $2,500 │ $3,125 Memory corruption from web contents, ASAN read │ $1,000 │ $1,250 Base reward (below-baseline report, mitigated issue, or no harness available) │ $500 │ $625 Submit a vulnerability CVE history 10 Last 12 months 95 Lifetime Memory safety 70 % Parsing/validation 18 % Denial of service 6 % Info disclosure 4 % Latest advisories Loading the feed Overview PDFium is the inline PDF viewer in Chrome, Edge and every Chromium derivative, which makes it the most-used PDF renderer on earth by document count. It reaches well past the browser too: its Foxit lineage puts it inside commercial SDKs, and the pypdfium2 bindings put it inside Python document pipelines, OCR stacks and LLM ingestion tooling. PDF is a format people open from email attachments without thinking, so PDFium sits on one of the shortest untrusted-input-to-parser paths in computing, and 70% of its 95 CVEs are memory-safety defects. Google names it explicitly in the Chrome VRP scope text, alongside Skia, which makes the scope evidence here unusually solid. The program pays $500 for a below-baseline report and up to $5,000 on the standard table for a controlled write reached from web contents, with a full chain built on the bug separately eligible for $250,000; because PDFium runs in a sandboxed renderer, a routine memory-safety finding lands at $500 to $1,000 unless you can show it escaping. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The Chrome VRP names PDFium in its own scope text, as one of the third-party components Google ships or uses, so any High or Critical bug in it that reaches Chrome qualifies The document, object and cross-reference parser, including the xref stream and repair paths that run on deliberately broken files Embedded stream filters: Flate, LZW, RunLength, ASCIIHex, ASCII85, CCITTFax, JBIG2, DCTDecode and JPX through OpenJPEG The content-stream interpreter and the render pipeline: graphics state, paths, clips, shadings and transparency groups Font handling for CFF, Type1, TrueType and CID fonts embedded in the document itself Forms: CPDFSDK and AcroForm handling, XFA where it is enabled, and JavaScript inside a PDF through the embedded engine Image extraction and colour-space conversion, where document-controlled dimensions drive allocation, along with the document security handlers and encryption The embedder API Chrome calls into and the print-preview path, which reaches the same code through a different entry point Out of scope PDFium consumed standalone outside Chrome, which is its main non-browser use, unless the bug also manifests in Chrome Experimental features, debugging features and unsafe browser flags, per the program's standard exclusions Code on trunk less than seven days old, which has not reached any shipping channel Reports filed to the Google OSS VRP rather than the Chrome VRP, where a product vulnerability pays nothing Speculative reports that do not demonstrate the bug actually manifesting in a shipping browser Anything below the High or Critical bar the scope sentence sets, along with low-quality submissions, which are capped at the $500 base amount Most-valued findings Memory corruption that escapes the PDF renderer sandbox and reaches the browser, network or GPU process from web contents. That is the only path from PDFium to the $5,000 controlled-write rung, and the one worth building Use-after-free in form handling or in the PDF JavaScript engine, where document script can free an object and keep using it, which is the classic PDFium exploitation primitive Heap corruption in the image filter chain, especially JBIG2 and JPX, where document-supplied parameters drive decoder allocation Object and cross-reference parser confusion on a deliberately corrupted file, since the repair paths are the least-exercised code in the engine Embedded font parsing bugs in CFF, Type1 or TrueType data carried inside the document, which reach a parser most people forget is reachable from a PDF Cross-origin or local-file information disclosure out of the viewer, which is a much rarer class here but reaches the User information disclosure rung rather than the base amount Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File to the Chrome VRP, not the Google OSS VRP, where PDFium's absence from the tier file means a product vulnerability pays nothing PDFium used standalone outside Chrome is out of scope unless the bug also manifests in Chrome, which rules out most of its non-browser deployments PDFium executes in a sandboxed PDF renderer process, so a routine memory-safety report is priced on the lower Other Processes table at $500 to $1,000 unless you demonstrate an escape The bug must manifest in an active Stable, Beta or Dev channel on the latest operating system and 64-bit hardware, and code less than seven days old on trunk is excluded Show the bug on a default configuration: experimental features, debugging features and unsafe flags are excluded, and XFA in particular is only interesting where it is actually enabled Disclosure Coordinated through the Chromium issue tracker, where reports are made public 14 weeks after being marked as fixed. Hold the detail until the program confirms a fix has shipped and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability