Bigger Rewards, New Targets Announced for Mozilla Bug Bounty Program

guest · Nov 20, 2019

Bigger Rewards, New Targets Announced for Mozilla Bug Bounty Program
November 20, 2019
https://www.securityweek.com/bigger-rewards-new-targets-announced-mozilla-bug-bounty-program

Mozilla announced on Tuesday that it’s doubling all payouts for vulnerabilities found in critical and core websites and services, and the maximum reward for remote code execution flaws affecting critical sites has been tripled to $15,000.
Mozilla says the increased bounties have already been applied to the most recent vulnerability reports.

The list of critical and core assets covered by the program has also been updated, with several new websites and services added to each category.
Mozilla says the goal of these changes is to encourage researchers to analyze its websites and services, and help it make its products safer.
Click to expand...

guest · Aug 20, 2020

Mozilla extends bug bounty program to cover exploit mitigation bypass payouts
HTML Sanitizer check
August 20, 2020
https://portswigger.net/daily-swig/...am-to-cover-exploit-mitigation-bypass-payouts

Mozilla has extended its well-established bug bounty program to offer rewards for the discovery of flaws in its exploit mitigation technology.

The new Exploit Mitigation Bounty will offer payouts of up to $10,000 to ethical hackers who work out mechanisms to defeat the exploit mitigation and defense-in-depth measures that are built into the Firefox web browser.
Exploit mitigation bugs that work without relying on privileged access will be eligible for a 50% bonus.

“While previously, bypassing a mitigation in a testing scenario – such as directly testing the HTML Sanitizer – would be classified as a sec-low or sec-moderate, it will now be eligible for a bounty equivalent to a sec-high,” Mozilla explains in a blog post.
“Additionally, if the vulnerability is triggerable without privileged access, this would count as both a regular security vulnerability eligible for a bounty and a mitigation bypass, earning a bonus payout.”
Click to expand...

The latest changes follow a major revamp to Mozilla’s bug bounty program back in April that offered higher payouts and ditched the previous ‘first reporter wins’ policy in favor of shared financial rewards.

Mozilla told The Daily Swig that its ongoing restructuring would have no affect its bug bounty strategy.

"Our latest Bug Bounty Program update is part of a broader initiative that aims to enhance collaboration with researchers by sharing our work and opening it up for scrutiny from established as well as emerging security researchers in the bug bounty community," it said. "Security of our users remains integral to our work on Firefox. We are moving forward with the program as originally planned."
Click to expand...

Log in or Sign up

Bigger Rewards, New Targets Announced for Mozilla Bug Bounty Program

guest Guest

guest Guest

Log in or Sign up

Bigger Rewards, New Targets Announced for Mozilla Bug Bounty Program

guest Guest

guest Guest

Useful Searches