Google introduced Mobile VRP (vulnerability rewards program), a new bug bounty program for reporting vulnerabilities in its mobile applications.
Google announced a new bug bounty program, named Mobile VRP (vulnerability rewards program), that covers its mobile applications.
Google’s Mobile VRP is a bug bounty program for reporting vulnerabilities in first-party Android applications developed or maintained by Google.
Only apps published by the developers in the list below or apps in the Tier 1 list (Google’s Play Services, AGSA (Android Google Search app), Chrome, Cloud, Gmail, and Chrome Remote Desktop) are in covered by the new program:
- Google LLC
- Developed with Google
- Research at Google
- Red Hot Labs
- Google Samples
- Fitbit LLC
- Nest Labs Inc.
- Waymo LLC
- Waze
The IT giant will reward arbitrary code execution vulnerabilities and flaws that can lead to the theft of sensitive data. The company is also looking for:
- Path traversal / zip path traversal vulnerabilities leading to arbitrary file write
- Intent redirections leading to launching non-exported application components
- Vulnerabilities caused by unsafe usage of pending intents
- Orphaned permissions
Below is the table reporting the rewards offered by the company for the different categories of vulnerabilities and the level of user interaction for their exploitation:
| Category | 1) Remote/No User Interaction | 2) User must follow a link that exploits the vulnerable app | 3) User must install malicious app or victim app is configured in a non-default way | 4) Attacker must be on the same network (e.g. MiTM) |
|---|---|---|---|---|
| A) Arbitrary Code Execution | $30,000 | $15,000 | $4,500 | $2,250 |
| B) Theft of Sensitive Data | $7,500 | $4,500 | $2,250 | $750 |
| C) Other Vulnerabilities | $7,500 | $4,500 | $2,250 | $750 |
The white hackers can ear up to $30,000 for vulnerabilities in Tier 1 apps that can be exploited remotely without user interaction to achieve arbitrary code execution.
“The panel can apply a discretionary $1,000 bonus – e.g. for a particularly surprising vulnerability, or an exceptional writeup.” states the announcement. “When investigating a vulnerability, please only ever target your own accounts. Never attempt to access anyone else’s data, and do not engage in any activity that would be disruptive or damaging to your fellow users or to Google.”
Bug hunters interested in taking part in the Mobile VRP should submit their findings through Google’s report page.
We are in the final!
Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini
Please nominate Security Affairs as your favorite blog.
Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, bug bounty)
Share On
