Google offers bounty for Chrome bug catchers

 

Gallery

By Stewart Mitchell

Posted on 1 Feb 2010 at 10:14

Google is to offer a bounty for anyone spotting security vulnerabilities in the Chrome browser and its underlying open-source code, the company has announced.

The search and software giant will pay a standard $500 (£314) for new security bugs reported to the Chromium project, with spotters of particularly severe bugs eligible for a $1,337 (£840) finder's fee.

“We're always looking to stay on top of the latest browser security features," said Chrome security expert Chris Evans on the Chromium project's blog. "Some of the most interesting security bugs we've fixed have been reported by researchers external to the Chromium project.

“We are hoping that the introduction of this program will encourage new individuals to participate in Chromium security. We will typically focus on high and critical impact bugs, but any clever vulnerability at any severity might get a reward."

The move mirrors the strategy employed by the Mozilla open-source software project, which operates a long-running vulnerability reward system for external experts spotting flaws in its security.

According to Google, any bug filed through the company's Chromium bug tracker under the template "Security Bug" will qualify for consideration.

However, Google employees looking to top up their wages with insider secrets won't be able to able to claim any reward. “Obviously, your bug won't be eligible if you worked on the code or review in the area in question,” says Evans.