TensorFlow.js

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Parsing/validation 35 % Memory safety 25 % XSS 20 % Code execution 15 % Latest advisories Loading the feed Overview TensorFlow.js is the dominant way machine-learning models run inside a web page, shipped in consumer web apps, browser extensions and a long tail of Node.js services through tfjs-node . The security-relevant fact about it is the loader: a page hands the library a URL, and the library fetches model.json plus binary weight shards from it and reconstructs a model topology out of JSON that nobody validated. In the browser that parse runs in the page's own origin; through tfjs-node , which binds to the native TensorFlow C library, the same parse runs as native code on a server. Zero recorded CVEs on a library with that shape reflects how little anyone has looked at it, not how safe it is. Google prices the repository at Tier OT1 on the Bug Hunters open-source VRP, $101 to $3,133.70 for a product vulnerability at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the public repositories of Google-owned GitHub organisations, and the tier file names tensorflow/tfjs at TIER_OT1. A product vulnerability anywhere in that repository is accepted, at $101 to $3,133.70 The model-loading path end to end: tfjs-converter , the model.json reader and the binary weight-shard fetch, all of which pull from whatever URL the calling page hands the library Deserialisation in tfjs-layers and tfjs-core : model topology, layer classes, custom-object resolution and the config a saved model carries tfjs-core itself, meaning the tensor abstraction, dtype and shape validation, and the op and kernel registry every backend dispatches through All of the execution backends the repository ships: WebGL, WebGPU, the CPU backend, and tfjs-backend-wasm with its SIMD kernels, each running in the page's own origin tfjs-node and tfjs-node-gpu , the Node bindings to the native TensorFlow C library, where the same inputs become native code on a server The surrounding packages in the monorepo, including tfjs-data and tfjs-react-native , and the conversion and inspection utilities shipped alongside them Repository configuration and the npm release pipeline behind the @tensorflow/* packages, which Google prices under its separate supply-chain category Out of scope Browser engine bugs, which belong to the browser vendor's own program rather than to the library running inside it Application-level XSS in a site that happens to use TensorFlow.js but whose flaw is in the site's own code Model accuracy and adversarial-input research, which is ML robustness rather than a software vulnerability Google repositories the tier file does not name, which sit at OT2 or OT3 and pay nothing for a product vulnerability Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions Memory-corruption reports filed without exact OSS-Fuzz reproduction steps against an existing fuzz target, or an already merged patch Awards to researchers on a sanctions list, in a territory subject to sanctions, or located in Russia or Belarus, which Google states it cannot pay Most-valued findings A crafted model.json that reaches code execution while the loader parses it: parsing and validation is 35% of the profile here and this is the finding that reaches the top of the $3,133.70 band, because loading a model from a URL is the library's advertised entry point A tfjs-layers deserialisation flaw that instantiates a class or resolves a callable the page never registered, which is the JavaScript analogue of an unsafe model load The same parse demonstrated through tfjs-node , where the impact stops being a compromised tab and becomes native code on a server Out-of-bounds access in a tfjs-backend-wasm SIMD kernel driven by weight shapes and strides taken from the model file Weight-shard handling that lets a model's binary payload be read or written outside the tensor it was allocated, including through the WebGL and WebGPU texture paths Anything in the loader or converter that turns model metadata into markup or into a DOM write, which is where the 20% XSS share becomes an origin compromise Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The repository is rated TIER_OT1 in Google's tier file, so product vulnerabilities cap at $3,133.70 rather than the $7,500 available to OT0 projects The $13,337 figure quoted for OT1 is the supply-chain-compromise category, covering Google source or build integrity rather than a code vulnerability in the repo Memory-corruption reports in OT0 and OT1 repositories need exact OSS-Fuzz reproduction steps or a patch already merged upstream, which matters most for the tfjs-node and WASM paths The bug has to be in the library rather than in a site that uses it: application-level XSS in a page that happens to load TF.js is not a finding here The award is set by a discretionary panel, so the band is a range rather than a fixed table and a report that spells out real impact is what moves you up it Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters, with the fix landing in tensorflow/tfjs and shipping out through the npm packages. Because the program's rules can be read as barring a third-party hand-off before the fix, file with Google directly and hold the detail: sites pin package versions and a loader bug is exploitable against any page that fetches a model from a URL an attacker can influence. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability