From ae2101d6621cbe0b99b6747beb89bcf19e17d9e5 Mon Sep 17 00:00:00 2001 From: Tom Ritter Date: Thu, 4 Jun 2026 16:04:09 -0400 Subject: [PATCH] Bug Bounty Policy Changes - Half memory corruption payouts - Clarify that UXSS requires an uncompromised content process - Remove the static analysis bug bounty --- .../templates/security/bug-bounty/faq.html | 1 + .../templates/security/client-bug-bounty.html | 135 ++++++++---------- media/css/security/client-bug-bounty.scss | 3 +- 3 files changed, 61 insertions(+), 78 deletions(-) diff --git a/bedrock/security/templates/security/bug-bounty/faq.html b/bedrock/security/templates/security/bug-bounty/faq.html index 299babc8c9d..e7121b32f45 100644 --- a/bedrock/security/templates/security/bug-bounty/faq.html +++ b/bedrock/security/templates/security/bug-bounty/faq.html @@ -269,6 +269,7 @@

Eligible bugs

users now have a sandboxed GPU process, and we are working on enabling it for all users whether or not additional vulnerabilities are found.

+

Bug reporting, etc.

diff --git a/bedrock/security/templates/security/client-bug-bounty.html b/bedrock/security/templates/security/client-bug-bounty.html index 153c4ebe74a..9e2057676aa 100644 --- a/bedrock/security/templates/security/client-bug-bounty.html +++ b/bedrock/security/templates/security/client-bug-bounty.html @@ -23,7 +23,7 @@

Introduction

The Mozilla Client Security Bug Bounty Program is designed to encourage security research in Mozilla software and to reward those who help us create the safest Internet software in existence.

-

Guidelines: Our general eligibility requirements apply to the Client Bug Bounty Program. Submissions must be either a static analysis submission, exploit mitigation bypass or a security bug demonstrating the ability to perform an unauthorized action or obtain access to otherwise-restricted information. We recommend that you read our Frequently Asked Questions before submitting.

+

Guidelines: Our general eligibility requirements apply to the Client Bug Bounty Program. Submissions must be either a security bug demonstrating the ability to perform an unauthorized action or obtain access to otherwise-restricted information or an exploit mitigation bypass. We recommend that you read our Frequently Asked Questions before submitting.

Security Vulnerability Bounty

@@ -41,23 +41,16 @@

Security Vulnerability Bounty

Rewards Amount

-

The bounty for valid potentially exploitable critical and high security rated client security vulnerabilities will be between $20,000 and $3,000 (USD) cash reward, depending on the impact of the vulnerability and the quality of the report, as detailed below.

+

The bounty for valid potentially exploitable critical and high security rated client security vulnerabilities will be up to a $20,000 cash reward, depending on the impact of the vulnerability and the quality of the report, as detailed below.

+ +

The bounty program encourages the earliest possible reporting of potentially exploitable bugs. A bounty is not determined based on the initial submission, but rather on the outcome of the discussion with developers. Improving test cases post-submission, figuring out if an engineer's speculation is founded or not, or other assistance that helps resolve the issue will increase your bounty payout. However, words have dminishing returns, and excessive comments (typically AI-generated) decrease the value of the report. Reproduction testcases provide more value than descriptions. Additionally, a report should not have severity keywords set or include CVSS scores.

+ +

Typically bounties are not paid for issues which cannot be identified/fixed from the report. While we do adhere to a first reporter-rule (with a 48-hour collision window), exceptions are made for reports that are not actionable and require additional information provided by another party.

-

The bounty program encourages the earliest possible reporting of potentially exploitable bugs. A bounty is not determined based on the initial submission, but rather on the outcome of the discussion with developers. Improving test cases post-submission, figuring out if an engineer's speculation is founded or not, or other assistance that helps resolve the issue will increase your bounty payout.

Baseline Report

High Quality Report

@@ -67,14 +60,14 @@

Rewards Amount

  • Submissions that include some aspects of a high quality report will qualify for a bounty between the minimum and maximum.
  • Notes:
    • @@ -89,52 +82,70 @@

    Rewards Amount

    - Highest Impact + Highest Impact + + + + + + • Sandbox Escape0 $20,000 $18,000 - + - + • Sandbox Escape (Memory Corruption)0 + $10,000 + $8,000 - + - + •Bypassing WebExtension install prompts1 + $20,000 + $18,000 Higher Impact + + + + + + • UXSS2 + $10,000 $8,000 + + High Impact + + + + + - + • Vulnerabilities not fitting 'Higher' or 'Highest Impact', but still receiving a sec-high rating + $5000 + $3000 - - - High Impact - Vulnerabilities not fitting 'Higher' or 'Highest Impact', but still receiving a sec-high rating + + + • Memory Corruption-based sec-high vulnerabilities - $5,000 - $3,000 + $2500 + $1500 - + - + • sec-high rated address bar spoofs
    + • Memory corruption in the GPU process
    + • Information disclosure from the parent to a less privileged process (e.g. out-of-bounds memory reads via IPC) Typically $3000 @@ -148,21 +159,17 @@

    Rewards Amount

    $2,500 - $500 - + - + • Memory Corruption triggered by an OOM condition3 Typically $1,500 - + - + • Persistent-DOS of browser across restarts or a DOS requiring reboot of user’s computer4 Typically $1,000 @@ -171,11 +178,13 @@

    Rewards Amount

    +

    Note that because advances in vulnerabilitiy detection techniques have made these easier to discover, memory corruption based vulnerabilities, as well as those that can be discovered by an ASAN build, will now be paid at half the rate of the category.

    +

    0A sandbox escape is defined as a method to run arbitrary attacker code with full user privileges in the parent process or natively on the user's computer. This can be achieved either through memory corruption or Javascript-based vulnerabilities. Vulnerabilities that assume arbitrary code execution in the content process - such as invoking an IPC method with attacker-controlled parameters - do qualify for Highest Impact.

    1 For Highest Impact, bypassing WebExtension Install Prompts excludes local attacks.

    -

    2UXSS is defined as the ability to execute JavaScript in an arbitrary cross-origin context. As mentioned above, complex user interaction or limited capabilities of the vulnerability (such as only being able to inject into a cross-origin domain, but not an arbitrary cross-origin domain) may decrease the bounty award.

    +

    2UXSS is defined as the ability to execute JavaScript in an arbitrary cross-origin context. As mentioned above, complex user interaction or limited capabilities of the vulnerability (such as requiring a compromised content process, or only being able to inject into a cross-origin domain but not an arbitrary cross-origin domain) may decrease the bounty award.

    3 If precise control of the OOM condition can be demonstrated, this will be considered High Impact.

    @@ -223,42 +232,14 @@

    Exploit Mitigation Bug Bounty

    Note: If you’re in the Bounty Bonus category, you may think submitting them separately could earn you slightly more money than submitting them together. We’re pretty sure that doing so would make the second report bounty-ineligible, but if you think each issue is fully independent, you’re welcome to submit them separately and we’ll consider it.

    -

    Static Analysis Bounty

    - -

    We also have a program that rewards the submission of static analysis tools that identify present or historical security vulnerabilities in Firefox. We will accept static analysis queries written as clang-based checkers - we have some documentation that may help you get started or integrate and run over Firefox as a whole. Submissions should be made following our instructions below.

    - -

    We will issue a bounty for the query itself, dependent upon the quality of the submission. Updated April 9, 2026: Because the use of AI tooling has made this significantly simpler, we are adjusting the expected range of the bounty to $500 - $5000. Additionally, circumstances regretfully may result in submissions not being evaluated in a timely fashion - but we will always honor the usefulness of a submission at the time it was made, not in light of current-day practices.

    - -

    Additionally, if your query matches presently unknown security vulnerabilities, each vulnerability it matches will be considered for a bounty independently. The amount awarded is dependent on the submission quality, as per normal bounty policy. For example purposes, we’ll assume a high or critical vulnerability (which is the most common case for memory corruption.) A report that only shows the output of the tool would be at the minimum end ($3000), and may be less if you submit multiple false positives we need to spend time validating. However a report that includes documentation explaining and validating that the issue is in fact a vulnerability would be eligible for an increased payout. A submission that includes documentation and a test case (which we acknowledge may be difficult for bugs found via this method) would be eligible for the maximum end ($5000).

    - -

    The quality of the static analysis submission will be judged on:

    - - -

    More about "Complexity of the query": Consider a function that returns -1 for error, 0 for failure, and 1 for success. Miscasting this return value into a boolean is a common mistake, and we surely have some historical instances of this in our code base. If you identify a function that still has this (bad) API, such a simplistic syntactical query is still valuable to us. If the API is ours, we should fix the API and if the API isn’t ours, we should use static analysis to prevent such a flaw from occurring. But it’s not a very sophisticated query. On the flip side, a query that does data flow analysis between a user-controlled source and attacker-controlled sink, accounting for complex transitions along the way (like IPC or JS/C++ boundaries) - that is a very sophisticated query.

    - -

    Examples of Quality of Submission: As mentioned, the bounty amount we grant for the query will be determined based on the quality of the submission, and an estimation of the number of issues we think it may identify in a one to three-year timespan. On the low end, if you submit a query that identifies a single historical issue of a syntactical misuse of an API we are unlikely to use in future code, we may not issue a bounty, and if we did it would be at the very low range. And on the high end, if you submit a query that matches 3 unknown issues today, in code written in the last year - we can expect it will identify a significant number of issues in the future and would be looking above the high range. (Plus you’d be eligible for separate bounties on those 3 issues.)

    - -

    Note: While we previously accepted submissions of CodeQL queries, we no longer do. You are of course encouraged to develop CodeQL queries if you think they will be valuable, and submit any findings you glean from them.

    -

    Claiming a Bug Bounty

    To claim a bounty:

    diff --git a/media/css/security/client-bug-bounty.scss b/media/css/security/client-bug-bounty.scss index b61eac64f33..8c61d780aee 100644 --- a/media/css/security/client-bug-bounty.scss +++ b/media/css/security/client-bug-bounty.scss @@ -5,9 +5,10 @@ @use '~@mozilla-protocol/core/protocol/css/includes/lib' as *; .mzp-u-data-table { - td:has(> ul) { + tr.bullet td, td.bullet, td:has(> ul) { border-top: 0; margin-top: $spacing-xl; + padding-left: 25px; } ul.multiple-item-list {