Mozilla has expanded its vulnerability rewards program

Mozilla announced on the expansion of the initiative to provide monetary rewards for identifying security issues in Firefox. In addition to directly addressing vulnerabilities, the Bug Bounty program will now also cover methods bypassing existing browser mechanisms that prevent exploit execution.

Such mechanisms include a system for sanitizing HTML fragments before use in a privileged context, memory separation for DOM nodes and strings/ArrayBuffers, the prohibition of eval() in the system context and parent process, strict CSP (Content Security Policy) restrictions on 'about:' service pages, prohibition of loading pages in the parent process other than 'chrome://', 'resource://', and 'about:', prohibition of executing external JavaScript in the parent process, and bypassing mechanisms for the separation of privileged (used to build the browser interface) and unprivileged JavaScript code. An example of an error that qualifies for the new reward is forgotten eval() check in Web Worker threads.

Upon discovering a vulnerability and bypassing protection mechanisms against exploits, the researcher can receive an additional 50% of the base reward, awarded for the identified vulnerability (for example, for a UXSS vulnerability that bypasses the HTML Sanitizer, it can yield $7000 plus a bonus of $3500). Notably, the expansion of the rewards program for independent researchers comes against the backdrop of the recent layoff of 250 Mozilla employees, under which fell into the entire Threat Management team, which handled the identification and analysis of incidents, as well as part of the Security team.

Moreover, it is reported that the rules for applying the rewards program to vulnerabilities identified in nightly builds have changed. It is noted that such vulnerabilities are often detected immediately during internal automated checks and fuzzing tests. Reports of such errors do not lead to improved security for Firefox or enhancements to fuzzing testing mechanisms; therefore, rewards for vulnerabilities in nightly builds will be granted only if the issue remains in the main repository for more than 4 days and has not been detected by internal checks and Mozilla employees.

Source: opennet.ru