Skia

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Memory corruption from web contents, controlled write in the browser, network or GPU process (this project's ceiling; the $250,000 full-chain rungs need a complete Chromium exploit) │ $5,000 │ $6,000 Memory corruption from web contents, ASAN write or use-after-free │ $2,500 │ $3,125 Memory corruption from web contents, controlled read │ $2,500 │ $3,125 Memory corruption from web contents, ASAN read │ $1,000 │ $1,250 Base reward (below-baseline report, mitigated issue, or no harness available) │ $500 │ $625 Submit a vulnerability CVE history 45 Last 12 months 103 Lifetime Memory safety 65 % Parsing/validation 15 % Denial of service 10 % Info disclosure 5 % Latest advisories Loading the feed Overview Skia is arguably the most widely deployed 2D graphics library in existence. It draws every pixel in Chrome and every Chromium derivative; it is the Android graphics stack, since hwui is built on it, so it renders the interface of billions of phones; it is Flutter's renderer, and therefore the drawing engine behind a large share of cross-platform mobile apps; and it is used by Firefox for some canvas paths, by LibreOffice and by Mozilla's PDF tooling. A heap overflow in Skia's path rasteriser is simultaneously a browser bug, an Android system bug and a mobile-app bug. It is also one of only two components Google wrote into the Chrome VRP scope text by name, which makes the scope evidence here about as strong as it gets, and 45 of its 103 Chrome CVEs landed in a single recent quarter. Google pays $500 for a below-baseline report and up to $5,000 for a controlled write in the browser, network or GPU process reached from web contents, with a full chain built on the bug separately eligible for $250,000; Mozilla pays independently for the copy vendored at gfx/skia. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The Chrome VRP names Skia in its own scope text, as one of the third-party components Google ships or uses, so any High or Critical bug in it that reaches Chrome qualifies Mozilla pays separately under its own line on third-party libraries incorporated into shipped client code, and Skia is present in the Firefox tree at gfx/skia The CPU rasteriser: paths, clips, blends, colour filters, image filters and mask filters, where geometry from a page becomes pixel arithmetic The Ganesh and Graphite GPU backends and the Vulkan, Metal, D3D and GL command streams they generate SkSL, Skia's shading language, and its compiler, a parser and code generator fed by page-controlled source The image codec front ends Skia owns, meaning SkCodec and the PNG, JPEG, WebP, GIF, BMP and AVIF wrappers around it Text handling: typefaces, glyph rasterisation and the font glue into FreeType and CoreText, all of it sitting on attacker-supplied glyph data Picture recording and serialisation, plus colour management and ICC profile handling Canvas2D, OffscreenCanvas, SVG filters and CSS paint surfaces as they are reached from Blink Out of scope Skia bugs reproducible only in Flutter or Android and not in Chrome, which fall outside the Chrome VRP entirely Experimental features, debugging features and unsafe browser flags, per the program's standard exclusions Code on trunk less than seven days old, which has not reached any shipping channel Reports filed to the Google OSS VRP rather than the Chrome VRP, where Skia's absence from the tier file means a product vulnerability pays nothing Speculative reports that do not demonstrate the bug actually manifesting in a shipping browser Anything below the High or Critical bar the scope sentence sets, along with low-quality submissions, which are capped at the $500 base amount Most-valued findings A controlled write in the GPU process reached from web contents through the Ganesh or Graphite backend. That is the top of the standard table at $5,000 and the class the 65% memory-safety share is concentrated in Path rasteriser memory corruption driven by pathological geometry, the historically richest vein in Skia and reachable from plain Canvas2D SkSL compiler defects where page-supplied shader source produces out-of-bounds behaviour or miscompiled code, since a shader compiler is a parser with a code generator behind it Image filter and blend chains that produce integer overflow in size arithmetic and then an undersized allocation the rasteriser fills SkCodec front-end bugs on malformed PNG, JPEG, WebP or GIF input, which sit on one of the shortest untrusted-input paths in the browser Any of the above that also reproduces in the copy Firefox vendors at gfx/skia, since that earns a second independent award for the same work Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File to the Chrome VRP, not the Google OSS VRP, where Skia's absence from the tier file means a product vulnerability pays nothing The bug must manifest in an active Stable, Beta or Dev channel on the latest operating system and 64-bit hardware, and code less than seven days old on trunk is excluded Reach the bug from web contents if you can: a defect driven through Canvas2D or SVG filters runs in the renderer and is priced lower than the same class of defect in the GPU process A Skia bug that reproduces only in Flutter or Android and not in Chrome falls outside this program, whatever its severity Skia is also vendored into Firefox at gfx/skia, which is a second, independent filing to Mozilla at only LOW routing risk: worth making separately Disclosure Coordinated through the Chromium issue tracker, where reports are made public 14 weeks after being marked as fixed. The Mozilla filing for the vendored copy is separate and carries no such bar. Hold the detail until the program confirms a fix has shipped and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability