Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included in the Edge Bounty Program.

The Microsoft Edge Bounty Program aims to find vulnerabilities that are specific to the upcoming Chromium-based Microsoft Edge, and that instantly affect customers’ security.

The Program invites people worldwide to look for and report Chromium-based Microsoft Edge-specific vulnerabilities.

Submissions that meet the requirements can earn bounty payments ranging from USD 250 to USD 30,000. 

Updated Criteria to be Eligible for Bounty Awards

For vulnerability submissions to be eligible for bounty rewards, applicants must fulfill the following requirements: 

Primarily, find a previously unreported vulnerability in the Dev, Beta, or Stable channels of Microsoft Edge that is exclusive to the Chromium platform and does not occur in the Google Chrome equivalent.

Further, this bounty program will take into account exploits in Microsoft Edge WebView2 that can be proven to work.

Microsoft Edge WebView2 Runtimes and SDKs: 

• WebView2 prerelease and release SDK
• Evergreen WebView2 runtime, and the runtimes in the Dev and Beta channel of Microsoft Edge

When a vulnerability is reported, it must be able to be reproduced using the most recent WebView2 SDKs and runtimes on the most recent, fully patched version of Windows, including Windows 10. 

Also, provide the WebView2 runtime version (e.g., Version 114.0.1823.79) and the WebView2 SDK version (e.g., 1.0.1905-prerelease or 1.0.2088.41) that were utilized to reproduce the vulnerability.

Under this bounty program, proven exploits in third-party components that reproduce in Microsoft Edge but not in Chrome are also eligible for consideration.

Microsoft said to provide clear, simple replication instructions in the form of written or video. Moreover, Proof of Concept (PoC) must be submitted with the submission.

Microsoft Edge on Chromium has a few features that make it stand out from the competition and could be useful areas to hunt for vulnerabilities that qualify for the Microsoft award. 

These can include, Internet Explorer (IE) Mode that needs a supported version of Windows, PlayReady DRM, Sign in with Microsoft Account (MSA) or Azure Active Directory (AAD), Application Guard, Edge PDF, and Microsoft Edge WebView2.

“A high-quality report provides the information necessary for an engineer to quickly reproduce, understand, and fix the issue.

This typically includes a concise write-up or video containing any required background information, a description of the bug, and an attached proof of concept (PoC)”, Microsoft said.

Researchers are encouraged to visit this page for details on Microsoft Bounty Programs and the associated terms and FAQs. 

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.