Chromium Bug Bounty Program Reward Criteria Explained

This article outlines the specific criteria used to determine financial payouts in the Chromium Vulnerability Reward Program (VRP). By examining factors such as report quality, privilege levels, vulnerability impact, attack preconditions, and mitigation bypasses, security researchers can understand how bug bounty rewards are calculated for the Chromium web browser.

Report Quality and Exploitability

The quality of the submitted report is the primary multiplier for any reward. The review panel categorizes submissions based on the level of effort and proof provided by the researcher:

  • Baseline Report: Provides a minimal reproduction case (Proof of Concept) that demonstrates a crash or security issue. This earns the minimum baseline payout for that specific vulnerability class.
  • High-Quality Report: Includes a minimized test case, a detailed root-cause analysis, and an explanation of how the bug could potentially be exploited.
  • Report with Functional Exploit: Demonstrates full exploitation, such as achieving Remote Code Execution (RCE) or stealing cross-origin data. Providing a working exploit unlocks the maximum possible reward tier, often adding tens of thousands of dollars to the baseline amount.

Privilege Level and Affected Process

Chromium uses a multi-process architecture to isolate web content from the underlying operating system. The process in which the vulnerability occurs heavily dictates the payout amount:

  • Renderer Process: Because the renderer is strictly sandboxed, vulnerabilities here (such as V8 JavaScript engine bugs or Blink rendering issues) receive lower base rewards compared to non-sandboxed processes.
  • GPU and Network Processes: These processes operate with higher privileges and weaker sandboxes than the renderer. Bugs found here yield medium-to-high rewards.
  • Browser Process: The main browser process runs without a sandbox and has full access to the user's system. Vulnerabilities executing in the browser process receive the highest payouts.
  • Sandbox Escapes: A vulnerability that allows an attacker to break out of the restricted renderer process and execute code in the browser process or operating system commands top-tier financial rewards.

Vulnerability Impact

The nature of what an attacker can achieve with the bug directly defines its severity tier:

  • Memory Corruption: Bugs like Use-After-Free (UAF), buffer overflows, and type confusion that lead to arbitrary code execution are paid at the highest tiers.
  • Same-Origin Policy (SOP) Bypasses: Universal Cross-Site Scripting (UXSS) or bugs that allow one website to read data from another website are treated with high severity, often equivalent to renderer code execution.
  • Information Disclosure: Bugs that leak sensitive cross-origin data or reveal memory layouts (which help bypass Address Space Layout Randomization) receive moderate rewards.
  • Spoofing and UI Redressing: Issues that trick the user, such as URL omnibox spoofing or bypassing permission prompts, generally receive the lowest tier of financial rewards.

Preconditions and User Interaction

The practicality of the attack in a real-world scenario acts as a modifier to the final bounty amount:

  • Zero-Click Exploits: Vulnerabilities that trigger simply by navigating to a malicious webpage receive 100% of the eligible reward amount.
  • User Interaction: If a bug requires the user to perform specific actions—such as clicking elements, dragging and dropping files, or using keyboard shortcuts—the reward is reduced based on how unlikely a user is to perform those actions naturally.
  • Configuration Requirements: To qualify for standard rewards, the bug must be present in the default configuration of the Stable, Beta, or Dev channels. Bugs requiring non-default command-line flags or experimental features rarely qualify for full payouts.

Mitigation Bypasses and Special Bonuses

Chromium actively deploys defense-in-depth mechanisms. Finding flaws in these defenses can trigger substantial bonus payouts:

  • MiraclePtr Bypasses: Chromium utilizes MiraclePtr (BackupRefPtr) to neutralize Use-After-Free vulnerabilities in the browser process. Discovering a functional bypass for MiraclePtr carries a significant standalone bonus.
  • V8 Engine Specifics: The V8 JavaScript engine has dedicated reward tiers. Exploits that target long-standing V8 code generally pay more than bugs found in newly committed, experimental features.
  • Fuzzer Wrangling: Researchers who submit bugs through the Chrome Fuzzer Program can earn extra bonuses on top of the standard VRP reward if their automated fuzzer discovers a security vulnerability in a standard build.