The Chromium Vulnerability Rewards Program has paid out more than $1 million dollars of total rewards for security researchers who have identified and reported Chromium security issues. While the number of reports has fallen off in recent months, Google maintains that the reduction speaks to the enhanced security that the program has helped to develop.
But, in an attempt to stay in front of the game, Google has decided to sweeten the pot. Among the highlights, the program has stacked an additional bonus of $1,000 or more on top of the base reward for “particularly exploitable” issues, assuming that the researcher can provide what the company defines as "a quick demonstration as part of the repro."
The company is also adding another $1,000 on top of the base reward for bugs located in portions of the code base deemed to be stable," or areas where the defect rate appears to be low.
[Related: How To Tackle Thorny IT Security Issues]
Add another $1,000 on top of the base reward if you can find vulnerabilities that extend beyond the Chromium platform. These might include "certain open source parsing libraries," according to Chris Evans, Google software engineer, in a prepared statement.
Payments are adjudicated by a special rewards panel that, at times, has approved overall rewards of $10,000 for findings that were deemed to be especially significant. These could be for particularly impressive findings, or for something that in Hollywood circles might be described as a lifetime achievement award.
To get the party started, Google is throwing down specific challenges in several key areas, such as Nvidia, ATI and Intel GPU driver vulnerabilities, high or critical severity vulnerabilities in the respective Windows drivers that are demonstrated and triggered from a Web page, and submissions on Chrome OS, particularly local privilege escalation exploits in Chrome OS via the Linux kernel.
Another example involves serious vulnerabilities in IJG libjpeg. "For well over a decade, there hasn’t been a serious vulnerability against IJG libjpeg. Can one be found?" Evans writes.
The program also covers vulnerabilities in Adobe Flash as well as other well-known software such as the Linux kernel, various open-source libraries and daemons, X windows, etc.
The base reward is $2,000 "for well-reported UXSS bugs, covering both the Chromium browser and also Adobe Flash." But, with the new bonus structure, the rewards are likely to increase to $4,000 in many circumstances.
PUBLISHED AUG. 16, 2012
