Pierluigi Paganini April 24, 2020

Mozilla announced some changes to its Firefox bug bounty program, it promises bigger rewards for vulnerabilities and will accept duplicate reports if necessary.

Mozilla announced some major changes to its bug bounty program that was first launched in 2004.

The organization paid out $965,750 for roughly 350 vulnerabilities, the average payout for each issue was approximately $2,700.

Now Mozilla has increased the maximum payout to $10,000 that will be paid for the highest severity vulnerabilities such as sandbox escapes, code execution flaws, and techniques for bypassing WebExtension install prompts.

Researchers could earn between $3,000 and $5,000 for reporting high-impact flaws such as memory corruption, same-origin bypass that results in user data leakage, and obtaining a user’s IP if a proxy is configured.

“Now, sandbox escapes and related bugs will be eligible for a baseline $8,000, with a high quality report up to $10,000.  Additionally, proxy bypass bugs are eligible for a baseline of $3,000, with a high quality report up to $5,000.” reads the announcement published by Mozilla. “And most submissions are above baseline: previously the typical range for high impact bugs was $3,000 – $5,000 but as you can see in the graphic above, the most common payout for those bugs was actually $4,000!  You can find full details of the criteria and amounts on our Client Bug Bounty page.”

Another novelty announced by Mozilla is its intention to allow duplicate submissions when researchers find the same vulnerability within hours of each other. Mozilla will divide the bug bounty for a flaw among all white hat hackers who reported the same vulnerability within 72 hours of the first report.

The organizations encourages the discussion with developers to increase the amount of the payouts, for example by increasing test cases post submission.

“Again, we want to emphasize – if it wasn’t already – that a bounty amount is not determined based on your initial submission, but rather on the outcome of the discussion with developers. So improving test cases post-submission, figuring out if an engineer’s speculation is founded or not, or other assistance that helps resolve the issue will increase your bounty payout.”concludes Mozilla. “And if you’re inclined, you are able to donate your bounty to charity – if you wish to do so and have payment info on file, please indicate this in new bugs you file and we will contact you.”

Last November, Mozilla announced that the top reward for security holes affecting its critical and core websites and services increased to $15,000.

Please give me your vote for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS
https://docs.google.com/forms/d/e/1FAIpQLSe8AkYMfAAwJ4JZzYRm8GfsJCDON8q83C9_wu5u10sNAt_CcA/viewform

Pierluigi Paganini

(SecurityAffairs – Mozilla, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]