Chromium Blog
News and developments from the open source browser project
Celebrating Six Months of Chromium Security Rewards
Dienstag, 20. Juli 2010
It has been approximately six months since we launched the
Chromium Security Reward program
. Although still early days, the program has been a clear success. We have been notified of numerous bugs, and some of the participants have made it clear that it was the reward program that motivated them to get involved with Chromium security.
We maintain a list of issued rewards on the
Chromium security page
. As the list indicates, a range of researchers have sent us some great bugs and the rewards are flowing! This list should also help answer questions about which sort of bugs might qualify for rewards.
Today, we are modifying the program in two ways:
The maximum reward for a single bug has been increased to
$3,133.7
. We will most likely use this amout for
SecSeverity-Critical
bugs in Chromium. The increased reward reflects the fact that
the sandbox
makes it harder to find bugs of this severity.
Whilst the base reward for less serious bugs remains at $500, the panel will consider rewarding more for high-quality bug reports. Factors indicating a high-quality bug report might include a careful test case reduction, an accurate analysis of root cause, or productive discussion towards resolution.
Thanks to everyone who contributes to Chromium security, and here’s looking forward to our first elite entrant!
UPDATE
: We've had a few questions about whether we pay rewards in cases where the bug comes to us via a vulnerability broker. Bugs reported in this way are not likely to generate Chromium rewards. We encourage researchers to file bugs directly with us, as doing so helps us get started sooner on fixes and removes questions about who else may have access to the bug details. We'd also remind researchers that we don't necessarily require a working exploit in order to issue a reward. For example, evidence of memory corruption would typically be sufficient.
Posted by Chris Evans, Google Chrome Security
Labels
$200K
1
10th birthday
4
abusive ads
1
abusive notifications
2
accessibility
3
ad blockers
1
ad blocking
2
advanced capabilities
1
android
1
anti abuse
1
anti-deception
1
background periodic sync
1
badging
1
benchmarks
1
beta
65
better ads standards
1
billing
1
birthday
4
blink
2
browser
2
browser interoperability
1
bundles
1
capabilities
6
capable web
1
cds
1
cds18
2
cds2018
1
chrome
33
chrome 81
1
chrome 83
2
chrome 84
2
chrome ads
1
chrome apps
5
chrome beta
1
Chrome dev
1
chrome dev summit
1
chrome dev summit 2018
1
chrome dev summit 2019
1
chrome developer
1
Chrome Developer Center
1
chrome developer summit
1
chrome devtools
1
Chrome extension
1
chrome extensions
3
Chrome Frame
1
Chrome lite
1
Chrome on Android
1
chrome on ios
1
Chrome on Mac
1
chrome privacy
4
chrome releases
1
chrome security
6
chrome web store
32
chromedevtools
1
chromeframe
3
chromeos
4
chromeos.dev
1
chromium
6
cloud print
1
coalition
1
coalition for better ads
1
contact picker
1
content indexing
1
cookies
1
core web vitals
2
csrf
1
css
1
cumulative layout shift
1
dart
8
dashboard
1
Data Saver
3
Data saver desktop extension
1
day 2
1
deceptive installation
1
declarative net request api
1
design
2
developer dashboard
1
Developer Program Policy
2
developer website
1
devtools
13
digital event
1
discoverability
1
DNS-over-HTTPS
4
DoH
4
emscriptem
1
enterprise
1
extensions
27
Fast badging
1
faster web
1
features
1
feedback
2
field data
1
first input delay
1
form controls
1
frameworks
1
fugu
2
fund
1
funding
1
gdd
1
google earth
1
google event
1
google io 2019
1
google web developer
1
googlechrome
12
harmful ads
1
html5
11
HTTP/3
1
HTTPS
1
iframes
1
images
1
incognito
1
insecure forms
1
intent to explain
1
ios
1
ios Chrome
1
javascript
5
lab data
1
labelling
1
largest contentful paint
1
launch
1
lazy-loading
1
lighthouse
2
linux
2
Lite Mode
2
Lite pages
1
loading interventions
1
loading optimizations
1
mac
1
manifest v3
2
metrics
2
microsoft edge
1
mixed forms
1
mobile
2
na
1
native client
8
native file system
1
New Features
5
notifications
1
octane
1
open web
4
origin trials
2
pagespeed insights
1
pagespeedinsights
1
passwords
1
payment handler
1
payment request
1
payments
2
performance
3
performance tools
1
permission UI
1
permissions
1
play store
1
portals
3
prefetching
1
privacy
2
privacy sandbox
2
private prefetch proxy
1
Profile Guided Optimization
1
progressive web apps
2
Project Strobe
1
protection
1
pwa
1
QUIC
1
quieter permissions
1
releases
3
removals
1
rlz
1
safe browsing
1
Secure DNS
2
security
34
site isolation
1
slow loading
1
sms receiver
1
spam policy
1
spdy
2
spectre
1
speed
3
ssl
2
store listing
1
strobe
2
subscription pages
1
suspicious site reporter extension
1
TCP
1
TLS
1
tools
1
transparency
1
trusted web activities
1
twa
2
user agent string
1
user data policy
1
v8
6
video
2
wasm
1
web
1
web apps
1
web assembly
1
web developers
1
web intents
1
web packaging
1
web payments
1
web platform
1
web request api
1
web vitals
1
web.dev
1
web.dev live
1
webapi
1
webassembly
1
webaudio
3
webgl
7
webkit
5
WebM
1
webmaster
1
webp
5
webrtc
6
websockets
5
webtiming
1
writable-files
1
yerba beuna center for the arts
1
Archive
2021
Jan
2020
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2019
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2018
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2017
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2016
Dez
Nov
Okt
Sep
Aug
Jun
Mai
Apr
Mär
Feb
Jan
2015
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2014
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2013
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2012
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2011
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2010
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2009
Dez
Nov
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2008
Dez
Nov
Okt
Sep
Feed
Follow @ChromiumDev
Give us feedback in our
Product Forums
.