Samsung Mobile Security Rewards

Accepting reports KYC to get paid

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Top reward: $1,000,000 The rewards amount will range between USD $200 and USD $1,000,000 for qualified Reports.
Lowest reward: $200 The rewards amount will range between USD $200 and USD $1,000,000 for qualified Reports.
Safe harbor: Partial Participation in the rewards program and reporting to Samsung Mobile shall not involve any illegal activities:
Hall of fame: Yes Hall of Fame

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

8 assets you may test, 4 excluded.

eligible Samsung Mobile devices (including smartphones, tablets, wearable devices and personal computers)

Out of scope (4)

Vulnerabilities (affecting Samsung as well as other Android devices) that are covered by other bug bounty programs (Android Rewards, Qualcomm Bug Bounty, Samsung DS Bug Bounty, etc.)
Vulnerabilities in 3rd party software, in general
Vulnerabilities in services offered by other divisions of Samsung
Vulnerability of a 3rd party code that affects not only Samsung devices but also other Android devices

What the policy asks of you, and the bug types it won't reward, quoted from Samsung Mobile Security Rewards's policy.

Samsung Mobile services must not be interrupted and the reporting must not attack any Samsung internal or external servers, nor cause damage of data or physical assets.
Participation in the rewards program or reporting to Samsung Mobile must not violate any applicable laws and regulations, or infringe any third party rights (including intellectual property rights).
For rewards eligibility, participants are asked not to publish or disclose the vulnerability in public until coordination with Samsung via communication at [email protected]
Reported vulnerability or related exploits shall not be used for any illegal activities.
Reports not submitted through "ticketing system", but sent via direct email ( [email protected] ).

Software bugs that have ineligible or less-than-Low Security Impact
A behavior of the software that is consistent with the security concept implemented by Samsung
Require excessive preconditions to exploit a vulnerability such as physical connection to the device with hacking tools
Scenarios requiring excessive user interaction or tricking users like phishing or clickjacking
Reports based on information that is already public
Reports without a working PoC that demonstrates a concrete security impact, including reports based only on static code review
Reports that demonstrate only that a crash occurs, without evidence of a practical security impact
Scenarios that can be mitigated if secure lock (PIN, Pattern, Password, or Biometric) authentication is enforced

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake