TensorFlow

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 3 Last 12 months 438 Lifetime Memory safety 45 % Denial of service 25 % Parsing/validation 20 % Code execution 8 % Latest advisories Loading the feed Overview TensorFlow is still one of the two production ML frameworks and the one with the deepest enterprise and embedded footprint: TensorFlow Serving runs inference in production at a very large number of companies, TFLite runs on billions of Android devices and on microcontrollers via tflite-micro , and tfjs runs models in browsers. The security-relevant property is that model files and tensor inputs are frequently attacker-influenced in real deployments, uploaded images, user text, models pulled from third-party hubs, which puts the C++ kernel and parser code on an untrusted-input boundary at very large scale. Its 434 lifetime CVEs are a completed audit rather than an ongoing rate: roughly 400 advisories in 2021, 171 in 2022 during the systematic op-kernel fuzzing campaign, 21 in 2023, one in 2024 and none since, which means the easy kernels are gone and what is left needs real work. Google prices it at Tier OT1 on the Bug Hunters open-source VRP, $101 to $3,133.70 for a product vulnerability at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and the tensorflow org contributes five TIER_OT1 rows: tensorflow , serving , models , tfjs and tflite-micro . A product vulnerability anywhere in those repositories is accepted, at $101 to $3,133.70 The whole op kernel surface in tensorflow/core/kernels , reached with tensor shapes, dtypes and attribute values a caller supplies The runtime under those kernels: the executor and session layer, the Grappler graph optimisation passes, shape inference, resource and variable handling, and the allocators Model and checkpoint loading: SavedModel , GraphDef and MetaGraph protobuf parsing, checkpoint restoration, and the function library those files carry tf.io and tf.data : TFRecord reading, the image, audio and text decoders, the dataset pipeline ops, and the filesystem plugins including the remote ones The C and C++ API surface exposed by libtensorflow , the Python bindings above it, and the custom-op and delegate registration paths TFLite: flatbuffer model parsing, the interpreter and its built-in ops, and the delegates that hand work to accelerators tensorflow/serving model loading and version management, plus the gRPC and REST prediction endpoints it exposes to callers Repository configuration and the release pipelines behind the published packages, which Google prices under its separate supply-chain category Out of scope Model-level adversarial-example and ML-robustness research, which is not a software vulnerability Loading an intentionally malicious model, where the documentation already warns that models are code Python-level API misuse by the caller rather than a defect in the framework Third-party TensorFlow distributions and vendor forks, which are outside the tier file Memory-corruption reports submitted without exact OSS-Fuzz reproduction steps against an existing fuzz target, or a merged upstream patch Other repositories in the tensorflow org beyond the five the tier file lists, which pay nothing for a product vulnerability after the April 2026 rules update Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue Most-valued findings Memory corruption in a core/kernels op driven by crafted tensor shapes or dtypes, with OSS-Fuzz reproduction steps: memory safety is 45% of this project's enormous CVE history and remains the class that reaches the top of the $3,133.70 band A parsing flaw in SavedModel , GraphDef or checkpoint restoration that fires before the model is treated as trusted, since that is the path a model pulled from a public hub actually takes TFLite flatbuffer parsing or interpreter bugs, which are reachable on Android devices and on tflite-micro targets that have no memory protection to fall back on Image, audio or TFRecord decoder defects in tf.io and tf.data , because those readers sit directly behind ordinary user uploads in production pipelines Anything in tensorflow/serving reachable from an unauthenticated gRPC or REST prediction request, which turns a library bug into a remote one against an inference host A kernel or op the 2021-2022 fuzzing campaign did not cover, since the campaign is what exhausted the easy findings and the gaps are where the remaining value sits Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Tensorflow, serving, models, tfjs and tflite-micro are all rated TIER_OT1, so a finding has to land in one of those repositories, and product vulnerabilities cap at $3,133.70 The $13,337 figure quoted for OT1 is the supply-chain-compromise category, covering the repository or release pipeline rather than a code vulnerability in the repo Memory-corruption reports need OSS-Fuzz reproduction steps or a merged patch: send the crafted tensor shapes or model file, not a stack trace alone Google may route your report to its AI VRP instead of handling it under the open-source rules, which changes who assesses it and against which criteria The program tightened in April 2026 specifically because of AI-generated report volume, and this repository absorbs the most of it: an unverified LLM-produced finding will be closed Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters. TensorFlow has a long history of publishing GitHub security advisories with researcher credit and batching fixes into a release, so expect that shape and hold your writeup until the advisory is out. File with Google directly rather than routing the finding elsewhere first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability