Google opens up Chrone vulnerability reward program

By Robert Westervelt | Feb 3, 2010

0 comments

Facebook

LinkedIn

Digg

Google is rolling out a vulnerability reward program to provide an incentive for security researchers to cough up security vulnerabilities they discover in its fledgling Chrome browser.

In a Google Chromium Blog entry, Chris Evans, an information security engineer on Google's Chrome security team, said eligible Chrome flaws would be rewarded with a minimum of $500. More extensive coding errors resulting in severe vulnerabilities could receive more than $1,300 he said.

"We will be rewarding select interesting and original vulnerabilities reported to us by the security research community," Evans said. "The more people involved in scrutinizing Chromium's code and behavior, the more secure our millions of users will be."

Only vulnerabilities reported through the Chromium bug tracker are eligible for a reward.  Eligibility also applies to vulnerabilities discovered in browser plug-ins shipped with the Chrome browser by default.

The Chromium Project is open source and covers both the Chrome browser and the Chromium OS. Evans called the Chrome vulnerability program experimental and pledged Google's sponsorship of the rewards.

Mozilla announced its Bug Bounty Program in 2004, funded by Linux distribution, Linspire and Mark Shuttleworth, the founder of the Ubuntu Project, a linux distribution. Under Mozilla's program, reporters of valid critical security bugs receive a $500 cash reward and a Mozilla T-shirt.

Under Mozilla's guidelines, only remote exploits present in recent supported versions of Firefox or Thunderbird are eligible for a reward. Submitters cannot be the author of the coding errors as a contributor to the Mozilla project.

0 comments

Facebook

LinkedIn

Digg