XNNPACK

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Memory safety 50 % Parsing/validation 20 % Denial of service 15 % Code execution 10 % Latest advisories Loading the feed Overview XNNPACK is the default CPU inference backend for TensorFlow Lite and is also wired into PyTorch (both the XNNPACK backend and ExecuTorch), ONNX Runtime, MediaPipe and TensorFlow.js WASM. Measured by the number of devices that actually execute the code it has the widest footprint of any project in this niche: essentially every Android device running on-device ML, Chrome's WebAssembly ML paths, and a large share of embedded and mobile inference stacks. It is also hand-written SIMD micro-kernels in C and assembly, which is exactly the language and style where memory-safety bugs live, and its clean CVE record is an artefact of nobody looking rather than evidence of safety: the tensor shapes, strides and quantization parameters that drive those kernels come from a model file the caller downloaded. Google prices the repository at Tier OT1 on the Bug Hunters open-source VRP, $101 to $3,133.70 for a product vulnerability at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the public repositories of Google-owned GitHub organisations, and the tier file names google/XNNPACK at TIER_OT1. A product vulnerability anywhere in that repository is accepted, at $101 to $3,133.70 The whole micro-kernel library across every instruction set it targets: ARM NEON and SVE, x86 SSE through AVX-512, WebAssembly SIMD and the scalar fallbacks, where bounds arithmetic is written per kernel rather than enforced centrally Every operator the library exposes, including convolution, GEMM and fully-connected, pooling, softmax, elementwise arithmetic, resize and pad, all reached with tensor shapes and strides taken from a model file The subgraph and runtime API: shape inference, operator fusion, the memory planner and the workspace allocation that decides how much memory each operator may touch The quantized paths, covering INT8 and the packed weight formats, where scale and zero-point values feed directly into address arithmetic Microkernel selection and runtime CPU feature detection, which decides which of those code paths actually executes on a given device The pthreadpool integration used to parallelise execution, including work partitioning across threads Repository configuration and the build and release pipeline that downstream frameworks vendor from, which Google prices under its separate supply-chain category Out of scope Bugs in TensorFlow Lite, PyTorch or another framework that merely calls XNNPACK, which belong to the calling project's own program Performance regressions and numerical accuracy differences, which are not security issues Google repositories the tier file does not name, which sit at OT2 or OT3 and pay nothing for a product vulnerability Anything that only reproduces on a version other than the current one, since the program covers the latest release Memory-corruption reports filed without exact OSS-Fuzz reproduction steps against an existing fuzz target, or an already merged patch Awards to researchers on a sanctions list, in a territory subject to sanctions, or located in Russia or Belarus, which Google states it cannot pay Most-valued findings An out-of-bounds write in a micro-kernel driven purely by tensor shapes and strides taken from a model file: memory safety is 50% of the profile here and this is the finding that reaches the top of the $3,133.70 band, because it fires on any device that loads a downloaded model Integer overflow in quantized INT8 scale or zero-point handling that turns into an address computation past the end of the buffer Shape-inference logic in the subgraph runtime that allocates a smaller tensor than the operator subsequently writes into A kernel reachable only on one instruction set, since a bound checked on the AVX-512 path may be absent on NEON or WebAssembly SIMD and the WASM path executes inside the browser Work-partitioning flaws in the pthreadpool integration where two threads write overlapping regions of the same output tensor Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The repository is rated TIER_OT1 in Google's tier file, so product vulnerabilities cap at $3,133.70 rather than the $7,500 available to OT0 projects The $13,337 figure quoted for OT1 is the supply-chain-compromise category, covering Google source or build integrity rather than a code vulnerability in the repo Memory-corruption reports in OT0 and OT1 repositories need exact OSS-Fuzz reproduction steps or a patch already merged upstream, which for a kernel library means shipping the tensor shape and buffer that trigger the fault The award is set by a discretionary panel, so the band is a range rather than a fixed table and a report that spells out real impact is what moves you up it Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters, with the fix landing in the repository and then propagating out through TensorFlow Lite, PyTorch, ONNX Runtime and every other consumer that vendors the kernels. Because the program's rules can be read as barring a third-party hand-off before the fix, file with Google directly and hold the detail: downstream frameworks pin their own copies and take months to pick a fix up. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability