Bugs are an unpleasant fact of life for browser-makers -- but Google is proving just how serious it is about getting to the root of them. Google on Thursday launched a new Chromium Vulnerability Rewards Program to encourage bug hunters to report open doors in its open source browser.
With the new program, Google is essentially upping the ante for security researchers who invest their time to make Chromium more secure. Google so far has paid out more than $1 million in rewards to security researchers but software engineer Chris Evans said there`s been a drop off in reports recently.
"This signals to us that bugs are becoming harder to find, as the efforts of the wider community have made Chromium significantly stronger," Evans wrote in a blog post. Google figures harder-to-find bugs demand higher-than-usual rewards and is responding accordingly.
Big Bounty Bonuses
Under the new Chromium Vulnerability Rewards Program paradigm, Google is adding a bonus of $1,000 or more on top of the base reward for what it calls "particularly exploitable" issues.
"The onus is on the reporter to provide a quick demonstration as part of the repro," Evans explained. "For example, for a DOM-based use-after-free, one might use JavaScript to allocate a specific object type in the `freed` slot, resulting in a vtable dereference of 0x41414141."
Google is also adding a bonus of $1,000 or more on top of the base reward for bugs in stable areas of the code base. By "stable," Evans said, Google means that the defect rate appears to be low. Google is also adding a bonus of $1,000 or more on top of the base reward for serious bugs that impact a significantly wider range of products beyond Chromium.
What does Google mean by over "$1,000 or more on top of the base reward"? Google can decide that...
Google Ups Ante for Chrome Bug Hunters
Posted by
Asha 281 days ago
(http://www.newsfactor.com)
Who Voted for this Story
android
app
apple
apps
cloud
data
facebook
google
microsoft
mobile
oracle
samsung
security
windows
8
Comments