WebKit

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Browser attack, WebContent sandbox escape (highest row reachable from the WebKit tree; the $1,000,000 Kernel row needs a bug outside it) │ $300,000 │ $301,000 Browser attack, Web Content code execution (what most WebKit reports are) │ $10,000 │ $11,000 Submit a vulnerability CVE history 111 Last 12 months 1,641 Lifetime Memory safety 58 % Code execution 16 % Info disclosure 12 % XSS 7 % Latest advisories Loading the feed Overview WebKit is Safari, and Safari is the WebContent process on roughly two billion active Apple devices. It is also WKWebView, which renders in-app web content inside effectively every iOS app that shows a page, and until the EU DMA engine-choice carve-out it was the only engine permitted on iOS at all, which is why Chrome, Firefox and Edge on an iPhone were, and mostly still are, WebKit shells. Outside Apple, WebKitGTK is the engine of GNOME Web and WPE WebKit dominates set-top boxes, smart TVs and digital signage, and the PlayStation and Switch browsers are WebKit derivatives. A parsing bug in this tree is a phone bug, a television bug and a console bug at once. Apple pays for it through its own Security Bounty rather than through a platform, and the scope is outcome-based: Apple pays for the bug's effect on a shipping Apple platform, not for the commit. The highest row a WebKit finding can reach on its own is a WebContent sandbox escape at $300,000; plain code execution inside WebContent, which is what most reports here are, pays $10,000, and the $1,000,000 kernel row requires a bug outside this tree entirely. sorona.xyz adds 1.25× on top of whatever Apple awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Apple's declaration is outcome-based: the Security Bounty covers research across all Apple products and public-facing services, and the WebContent process on a shipping Apple device is WebKit. A bug anywhere in the github.com/WebKit/WebKit tree that Safari reaches on a shipped platform is covered. Apple pays for the effect on the platform rather than for the commit WebCore in full: the DOM, CSS and layout, rendering and compositing, SVG, editing and selection, and the HTML and XML parsers The loader and networking layer: URL parsing, resource loading, redirect handling, CORS, Content Security Policy, cookies and the cache, together with the security-origin checks the loader and the DOM both rely on The WebKit2 process architecture: the WebContent process sandbox, the multi-process IPC boundary, and the Networking and GPU process boundaries this tree defines Graphics and media: WebGL and WebGPU, canvas, the media pipeline, image decoders and font handling, including the copies bundled inside the tree The web platform features Safari ships: Service Workers, WebAssembly, IndexedDB and the other storage APIs, WebRTC, Web Crypto and Web Push The WebKit API surface Apple ships to app developers, WKWebView above all, which renders web content inside effectively every iOS app that shows a page JavaScriptCore, in the same repository under Source/JavaScriptCore and covered by the same Apple programme. It is listed separately on this site because its reachable ceiling is different Out of scope Apple Pay, non-public-facing Apple systems, and phishing or social engineering, all excluded by terms 5.1 to 5.3 Third-party services: "The Apple Security Bounty program does not extend to third-party services." Bugs only reproducible in WebKitGTK, WPE or another downstream port. Igalia maintains those and nobody pays for them Issues in unshipped trunk code, since Apple pays for the effect on a platform it has shipped rather than for the state of the tree Reports without a captured Target Flag, which do not reach the stated reward even when the underlying bug is real Submissions barred on eligibility rather than on merit: sanctions screening applies, an 18-month bar runs on former Apple employees, and an award lapses if it is not accepted within a year of being offered Most-valued findings A WebContent sandbox escape: renderer code execution turned into privileged user-space control through WebKit's own IPC layer or its bundled sandbox profiles. This is the $300,000 row and the only one the WebKit tree can reach on its own. Memory corruption in WebCore driven purely by parsing attacker-controlled HTML, CSS or XML, the single largest slice of the engine's CVE history at 58% memory safety Image decoder, font and media-pipeline memory safety, because those parse untrusted bytes on any page load and are reachable without user interaction beyond navigation GPU-process compromise reached through WebGL or WebGPU, which crosses a boundary WebKit defines and is the natural neighbour of the sandbox-escape class Universal cross-site scripting and same-origin bypass in the DOM and the loader. It is a smaller slice of the history at 7%, and it breaks the web's own trust boundary rather than a process one Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The bug has to affect a shipping Apple platform: a finding that only reproduces in WebKitGTK, WPE or another downstream port, or only in unshipped trunk code, earns nothing here Capture the Target Flag. Apple describes it as an objective confirmation of exploitability and it gates the stated reward, so a report without one does not reach the published figure Tell nobody but Apple until Apple has shipped the software update and published the advisory: that is an eligibility condition, not a courtesy Bonuses stack on the base award: 50% for an issue that only affects a beta, 100% for a Lockdown Mode bypass, 150% for both, and the whole award doubles again if you donate it to a qualifying cause Sanctions screening applies, an 18-month bar runs on former Apple employees, and an award has to be accepted within a year of being offered Disclosure Apple runs it end to end. The security advisory goes out with the OS release that carries the fix, with researcher credit, and nothing about the timetable is yours to set. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability