V8

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Memory-corruption / sandbox-escape RCE in the browser or another non-sandboxed process, high-quality report with working RCE PoC │ up to $250,000 │ up to $251,000 Controlled arbitrary-address write in a non-sandboxed process │ up to $90,000 │ up to $91,000 RCE in a highly-privileged process │ up to $85,000 │ up to $86,000 RCE in a sandboxed process │ up to $55,000 │ up to $56,000 Baseline memory corruption (non-sandboxed, no demonstrated write or RCE) │ up to $35,000 │ up to $36,000 High-quality client-side flaws (XSS, site-isolation bypass) │ up to $30,000 │ up to $31,000 MiraclePtr / BackupRefPtr bypass │ $250,128 │ $251,128 Submit a vulnerability CVE history 22 Last 12 months 200 Lifetime Memory safety 55 % Code execution 30 % Info disclosure 8 % Denial of service 7 % Latest advisories Loading the feed Overview V8 is the high-performance JavaScript and WebAssembly engine that powers Chrome and Node.js, so a single memory-safety bug here can reach billions of users. It already runs a paid bounty via the Google/Chrome Vulnerability Reward Program, where V8 type confusions and exploitable memory corruption command some of the program's largest payouts and full sandbox-escape chains reach the top tier. Route your report through sorona.xyz and we pay 1.25x whatever that program awards, plus up to $1,000 more for especially complex or well-chained bugs. In scope Memory-safety defects in production V8 as it ships in Chrome, including type confusion, use-after-free, and out-of-bounds reads or writes reachable from JavaScript or WebAssembly; any code that reaches even a fraction of users counts as shipped The optimizing JIT tiers, TurboFan and Maglev, where mis-optimizations and inline-cache or hidden-class (Map) type confusions turn into an attacker read/write primitive; historically roughly half of exploited V8 bugs live in a compiler The Ignition bytecode interpreter, the parser, the regular-expression engine, and V8 runtime builtins The V8 garbage collector and object-model machinery where a logic or lifetime bug yields controlled corruption of the V8 heap The WebAssembly pipeline, including the Liftoff baseline compiler and the TurboFan wasm tier, where codegen flaws lead to memory corruption or a sandbox escape The in-process V8 Sandbox (heap-isolation boundary), which the Chrome VRP has treated as a security boundary since Chrome 123 (March 2024): a bypass that escapes heap isolation to reach non-heap process memory is a distinct, separately rewardable finding on top of the underlying corruption MiraclePtr / BackupRefPtr, a declarative security boundary whose bypass is explicitly in scope Post-exploitation reach from a V8 or renderer compromise into the broader browser process, GPU process, network service, or across site-isolation boundaries, up to a full renderer-to-OS escape Third-party libraries bundled into Chrome (for example libxml, sqlite, image and compression code) when a V8 bug chains through them Out of scope Bugs specific to V8 features marked Experimental (as denoted by the flag definition in source, the flag's help-menu description, or a runtime warning), which the Chrome VRP does not reward Anything gated behind a flag that raises a warning infobar about user risk, or that reproduces only under --single-process, deprecated SwiftShader, or the not-yet-enabled WebNN surface Renderer out-of-bounds reads and DCHECK-only, SEGV-only, or plain-crash reports with no demonstrated write primitive or RCE (baseline consideration at best) Pure denial-of-service, memory exhaustion, or hangs with no security-relevant primitive Purely theoretical or static-analysis findings with no demonstrated security impact Issues living in third-party embedders such as Node.js integration code rather than in V8 itself Findings already reported, publicly known, or fixed on tip-of-tree at submission time Most-valued findings JIT and inline-cache type confusion (TurboFan/Maglev) that produces an arbitrary read/write primitive: the canonical top-value V8 bug class, as seen in reports like CVE-2025-10585 and CVE-2025-13223/13224 V8 Sandbox bypass: escaping the in-process heap-isolation boundary into non-heap memory, counted as a second distinct vulnerability layered on a heap-corruption bug and run through dedicated sandbox-bypass reward iterations Renderer-to-browser sandbox escapes and memory corruption in a non-sandboxed or highly privileged process leading to RCE (a full logic-bug exploit chain, CVE-2025-4609, was awarded the $250,000 top payout) WebAssembly compiler bugs, including Liftoff codegen flaws, that reach memory corruption or a sandbox escape MiraclePtr / BackupRefPtr bypasses Complete exploit chains that demonstrate RCE by running a shell with the user's privileges, which earn the top tier plus quality bonus Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Submit a minimized, self-contained proof of concept (poc.html or equivalent) with clear, deterministic reproduction steps Include the exact Chrome/V8 version, command line, build flags, and a symbolized ASAN stack trace for memory-safety bugs Test against current stable or tip-of-tree; report the earliest affected version where you can A working functional exploit is optional but raises the reward tier; the upstream program allows submitting it within roughly four weeks One distinct root-cause vulnerability per report; do not bundle unrelated issues No automated fuzzing dumps without triage, root-cause analysis, and a reproducible case Disclosure Coordinated disclosure only: give the upstream Chrome/V8 team reasonable time to ship a fix, following Google's standard 90-day disclosure window. Do not disclose publicly before a patch is released, as early disclosure can void the reward. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability