SpiderMonkey

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Highest Impact: a sandbox escape, or bypassing a WebExtension install prompt ($18,000 baseline, $20,000 with a high-quality report) │ $20,000 │ $21,000 Higher Impact: universal XSS ($8,000 baseline, $10,000 with a high-quality report) │ $10,000 │ $11,000 High Impact: other sec-high work such as an address-bar spoof, GPU-process memory corruption, or parent-to-child information disclosure ($3,000 baseline, and examples typically land at $3,000) │ $5,000 │ $6,000 Moderate Impact, at the committee's discretion │ $2,500 │ $3,125 Memory corruption triggered by an out-of-memory condition (typical award) │ $1,500 │ $1,875 Denial of service that persists across restarts, or that requires a machine reboot (typical award) │ $1,000 │ $1,250 Submit a vulnerability CVE history 40 Last 12 months 123 Lifetime Memory safety 60 % Code execution 20 % Parsing/validation 10 % Info disclosure 5 % Latest advisories Loading the feed Overview SpiderMonkey is Mozilla's JavaScript and WebAssembly engine, living in the Firefox tree at js/src and shipped as mozjs for everyone else. It runs in every Firefox install, in every Gecko-derived browser: Tor Browser, Mullvad, LibreWolf, Waterfox, Zen, and in Thunderbird; outside the browser it is the scripting engine behind GNOME Shell through gjs, which puts it in the desktop-session process of Fedora, Ubuntu and RHEL workstations. It is one of only three production-grade independently developed JavaScript engines. It also compiles attacker-supplied code for a living: 123 of Firefox's CVEs are JS-engine bugs and 40 of those landed in the last twelve months, roughly one every nine days. Mozilla pays for them on the Client Security Bug Bounty, with $20,000 at the top for a sandbox escape: a definition that explicitly includes JavaScript-based routes, not just memory corruption. sorona.xyz adds 1.25× on top of whatever Mozilla awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The declaration Firefox runs on covers this code as well: any security bug in the main development or released versions Mozilla ships, Nightly mozilla-central included. SpiderMonkey is in-tree at js/src and inherits the client table rather than running a program of its own. The parser, the bytecode emitter and the Baseline interpreter The Baseline JIT and the IonMonkey and WarpMonkey optimising compilers, together with the inline-cache and object-shape machinery they specialise against The garbage collector, the nursery and tenured heap boundary, and weak-reference and finalisation handling WebAssembly: the baseline and optimising Wasm compilers, and the Wasm/JS boundary The built-in library surface: TypedArrays and ArrayBuffer, Atomics and SharedArrayBuffer, Proxy and Reflect, JSON, Date and Intl irregexp, the regular-expression engine, which shares its lineage with V8 The structured-clone path and the JSAPI surface Firefox embeds the engine through Out of scope Pure crashes with no exploitability story attached Bugs only reachable in the standalone js shell under flags Firefox never sets Bugs in embeddings of mozjs outside Mozilla's shipped client, GNOME Shell's gjs for instance, unless they also manifest in Firefox End-of-life branches Denial of service that merely crashes the browser, which the program excludes in terms Bugs in code the reporter contributed themselves Reports from Mozilla employees, contractors, and anyone with a business relationship with Mozilla Mozilla's own websites and services, which pay off the separate HackerOne Web Bug Bounty table Most-valued findings A JIT type confusion or garbage-collector use-after-free driven all the way to attacker code in the parent process. Mozilla's sandbox-escape definition covers JavaScript-based routes, and that is the $20,000 row. WebAssembly compilation or Wasm/JS boundary flaws producing an out-of-bounds write from a page-supplied module Inline-cache and shape-guard failures that let an attacker-controlled object be treated as the wrong type, the mechanism behind most exploitable engine bugs Universal XSS reached through the engine, where the same-origin policy stops holding from script alone, at $10,000 Memory corruption triggered by an out-of-memory condition, priced separately at around $1,500 and a class JS engines produce far more of than most code Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Impact is assessed against Firefox, not against the standalone js shell; a shell-only repro under flags Firefox never sets does not pay Mozilla runs continuous JavaScript fuzzing and reserves a seven-day internal-discovery window, which bites harder here than anywhere else in the tree Your finding normally has to reach sec-high or sec-critical for a reliable payout Two reports of the same bug within 48 hours of each other split the bounty Do not put CVSS scores or CWE identifiers in the report; describe the impact instead File on Bugzilla through the client bounty form at bugzilla.mozilla.org/form.client.bounty Disclosure Coordinated with Mozilla through Bugzilla. JS-engine bugs are held in a security-restricted group and usually ride the next release train, after which Mozilla publishes an MFSA advisory with researcher credit. Its terms ask for a reasonable amount of time before any part of the issue is shared with a third party, so keep the test case private until the advisory ships. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability