Polymer

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime XSS 55 % Injection 20 % Info disclosure 15 % Access control 8 % Latest advisories Loading the feed Overview Polymer is the library where the usual health signals mislead in both directions. Google's own guidance points new work at Lit, upstream development is in maintenance and the repository looks dormant, and yet Polymer still carries YouTube's web front end, which was rebuilt on it and continues to run on it, alongside a long tail of Google product surfaces and enterprise intranets built during the web-components push. A flaw in template stamping or binding evaluation is therefore an XSS primitive against one of the highest-traffic web properties in existence, reached through data those pages render rather than through anything the attacker has to be trusted for. Google keeping a superseded library at Tier OT1 rather than letting it decay is itself the tell: the tier assignment tracks where the code is actually deployed, not whether the project is fashionable. There are no recorded CVEs at all, which on a library this old and this widely embedded reads as absence of attention rather than absence of bugs. Google pays for reports through the Open Source Software VRP at Tier OT1, where a product vulnerability runs from $101 to $3,133.70 and a discretionary panel decides where in that band a finding lands. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and Polymer/polymer is named in the published tier file at TIER_OT1: a product vulnerability anywhere in the library's own code is accepted, at $101 to $3,133.70 The PolymerElement base class in full: the property system, property effects, observers, computed and read-only properties, and the element lifecycle Template stamping and data binding, covering the {{ }} and [[ ]] evaluators, attribute and property bindings, and event-handler bindings The helper elements the library ships: dom-repeat , dom-if , dom-bind and dom-module , and the templatizer they are built on html template literal handling and every path that turns a value into markup, including the DOM writes the library performs on the application's behalf Styling and encapsulation: how the library uses Shadow DOM, how it falls back to the ShadyDOM and ShadyCSS polyfills, and custom-property and style-module resolution The legacy layer that still ships: Polymer({}) behaviours, the 1.x compatibility shims, gesture and event handling, and the async and utility modules Publication of @polymer/polymer to npm and the integrity of the released package, which Google prices under its separate supply-chain category Out of scope Lit and lit-html , the successor libraries, which are not listed in Google's repository tier file Applications built on Polymer rather than defects in the library itself Browser polyfill gaps in legacy browsers the project no longer supports Third-party Polymer element collections published outside the Polymer organisation Deprecated 1.x-only APIs that the project no longer ships Other repositories in the Polymer org, which the tier file does not list and which pay nothing for a product vulnerability after the April 2026 rules update Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue Most-valued findings A binding evaluator or template stamping path that turns attacker-influenced data into executing script, the class that dominates this library at 55% and the one that reaches YouTube's front end without the attacker needing any privilege Markup injection through dom-repeat or dom-if instantiation, where the structure of rendered DOM is decided by a value rather than by the template author A property-effect or html template literal path that produces markup from data the developer reasonably assumed would be escaped ShadyDOM or ShadyCSS behaviour that breaks the encapsulation an application depends on, letting content in one component reach or restyle another Any of the above shown to work against a default Polymer configuration rather than one the reporter had to weaken, since deployments on this library are old and rarely reconfigured Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Only Polymer/polymer is in the tier file; Lit and lit-html , the successor libraries, are not covered by this entry The library is in maintenance upstream, so expect a longer path from triage to a shipped fix than on an actively developed project: it is still listed and still payable Applications built on Polymer are not in scope; the defect has to be in the library's own templating, binding or polyfill code Frame the report accurately: a bug in the library's own code is a product vulnerability, while compromise of the repository or the npm release pipeline is a separate and differently priced supply-chain category Google Patch Rewards is a separate pathway that pays for a patch you land upstream and keep merged, not for a report, with its own rules and its own money Google's rules state that privately disclosing a flaw to a third party, for any purpose other than fixing it, will typically not qualify for a reward Disclosure Coordinated through Google Bug Hunters, which triages the report, lands the fix in Polymer/polymer and cuts an @polymer/polymer release. This project has no published advisory history, so expect credit in a release rather than a familiar CVE record, and expect the wait to be longer than on an actively developed library. Because Google treats a private disclosure to a third party as grounds for disqualification, file with Google directly and hold the detail until the fixed version is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability