Windows 10: Microsoft Announces the Microsoft Edge Insider Bounty

Brink · Aug 20, 2019

This week, we released the first Beta preview of the next version of Microsoft Edge. Alongside this, Microsoft is excited to announce the launch of the Microsoft Edge Insider Bounty Program. We welcome researchers to seek out and disclose any high impact vulnerabilities they may find in the next version of Microsoft Edge, based on Chromium, and offer rewards up to US$30,000 for eligible vulnerabilities in Dev and Beta channels.

We aim to complement the Chrome Vulnerability Reward Program, so any report that reproduces on the latest version of Microsoft Edge but not Chrome will be reviewed for bounty eligibility based on severity, impact, and report quality.

Valid reports affecting the next version of Microsoft Edge will receive a 2X bonus multiplier in the Researcher Recognition Program.

Faster rewards: the new Microsoft Edge bounty program will provide bounty will award upon completion of reproduction and assessment of each submission.

The new bounty program will run alongside the existing Microsoft Edge (EdgeHTML) on Windows Insider Preview bounty program. Vulnerabilities that reproduce in the latest, fully patched version of Windows (including Windows 10, Windows 7 SP1 or Windows 8.1) or MacOS may be eligible for the Microsoft Edge Insider bounty program. Windows Insider Preview is not required.

Program Eligible Vulnerabilities Award Range Microsoft Edge Insider Bounty Program Critical and important vulnerabilities in Microsoft Edge (Chromium-based) Beta and Dev channels. Up to $30,000 Microsoft Edge (EdgeHTML) on Windows Insider Preview Critical remote code execution and design issues in Microsoft Edge (EdgeHTML) in Windows Insider Preview Slow ring. Up to $15,000
We’re excited to expand our bounty programs today to include the next version of Microsoft Edge and continue to grown and strengthen our partnership with the security research community.

Happy Hacking!

Jarek Stanley, Senior Program Manager, MSRC
Click to expand...

Source: https://msrc-blog.microsoft.com/2019...annels-bounty/

Tweet

— Twitter API (@User) View on Twiiter

:)

Raevenlord · Aug 20, 2019

Microsoft Announces the Windows Bounty Program

While Microsoft has been offering bug bounty incentives since at least 2012, Google has arguably been much more vocal in its bug bounty programs. The company recently increased the maximum payout in its bug bounty programs (mainly focused on Android) to a staggering $200,000, and now Microsoft is not only following suit - it's upping the game.

With the Windows Bounty Program, which Microsoft announced yesterday, the company is looking towards an increased incentive to security-hardening suggestions from tech-savvy users. This program will extend to all features of the Windows Insider Preview in addition to focus areas in Hyper-V, Mitigation bypass, Windows Defender Application Guard, and Microsoft Edge. And incentives starting at $500 and going all the way up to $250,000 are very, very respectful.

Source: Blogs.Technet @ Microsoft

Brink · Aug 20, 2019

Extending the Microsoft Edge Bounty Program

Over the past ten months we have paid out over $200,000 USD in bounties. This collaboration with the research community has resulted in significant improvements in Edge security and has allowed us to offer more proactive security for our customers. Keeping in line with our philosophy of protecting customers and proactively partnering with researchers, today we are changing the Edge on Windows Insider Preview (WIP) bounty program from a time bound to a sustained bounty program.

Since 2013, we have launched three browser bounties to uncover specific vulnerabilities. As security is a continuous effort and not a destination, we prioritize identifying different types of vulnerabilities in different points of time. On August 4, 2016, we launched the Edge Web Platform bounty on WIP to incentivize researchers to send us remote code execution (RCE), same origin policy bypass vulnerabilities (example: UXSS), and referrer spoofing vulnerabilities in our latest browser. Microsoft is committed to delivering secure products to our customers and this bounty program helped us achieve that goal. We received many high-quality reports in Edge during this 10-month program which helped keep our customers secure.

The overall program highlights:

Any critical remote code execution or important design issue that compromises a customer’s privacy and security will receive a bounty

The bounty program is sustained and will continue indefinitely on Microsoft’s discretion

Bounty payouts will range from $500 USD to $15,000 USD

If a researcher reports a qualifying vulnerability already found internally by Microsoft, a payment will be made to the first finder at a maximum of $1,500 USD

Vulnerabilities must be reproducible on the latest Windows Insider Preview (slow track)

All security bugs are important to us and we request you report all Microsoft Edge browser security bugs to L: secure@microsoft.comvia Coordinated Vulnerability Disclosure (CVD) policy

For the latest information on new Windows features included in the Insider Previews, please visit the Windows 10 Insider Program Blog.

As always, the most up-to-date information about the Microsoft Bounty Programs can be found at Microsoft Bounty Programs | MSRC and in the associated terms and FAQs.

Akila Srinivasan
Microsoft Security Response Center
Click to expand...

Source: Extending the Microsoft Edge Bounty Program MSRC

See also: Microsoft Security :: Security Vulnerability | Report a Vulnerability | MSRC:

Brink · Aug 20, 2019

Extending Microsoft Edge Bounty Program

Over the past 10 months, we’ve paid out more than $200,000 USD in bounties to researchers reporting vulnerabilities through the Microsoft Edge Bounty Program. Partnering with the research community has helped improve Microsoft Edge security, and to continue this collaboration, today we’re extending the end date of the Edge on Windows Insider Preview (WIP) bounty program to June 30, 2017.

Details on what the program includes are noted in this TechNet post, and information on Microsoft Bounty Programs can be found at Microsoft Bounty Programs | MSRC.

– MSRC and the Microsoft Edge teams
Click to expand...

Source: Extending Microsoft Edge Bounty Program MSRC

Windows 10: Microsoft Announces the Microsoft Edge Insider Bounty

Microsoft Announces the Microsoft Edge Insider Bounty

Microsoft Announces the Microsoft Edge Insider Bounty

Microsoft Announces the Microsoft Edge Insider Bounty

Microsoft Announces the Microsoft Edge Insider Bounty - Similar Threads - Microsoft Announces Microsoft

Microsoft announces improvements to Collections in Microsoft Edge

Microsoft announces improvements to history in Microsoft Edge

Microsoft Announces the Xbox Bounty program

Announcing Changes to Microsoft’s Mitigation Bypass Bounty

Microsoft Announcing Speculative Execution Bounty Program Launch

Announcing Microsoft Edge for iOS and Android, Microsoft Launcher

Announcing the Windows Bounty Program

Extending Microsoft Edge Bounty Program

Extending the Microsoft Edge Bounty Program