Meta hardware devices

Max payout:

$45k*

Guidelines

These guidelines describe how we assess the security impact of bug submissions for Meta hardware devices and determine bounty payout amounts. These guidelines focus on certain devices in Meta Quest, Meta Portal, and Ray-Ban Meta smart glasses, and share how we determine payouts for specific categories of vulnerabilities. The full list of Meta devices eligible for bounty awards is below.

We will determine the overall payout amount on the maximum possible security impact of a bug report. For example, if rooting a device gives full access to the camera, we will issue the bounty payout for the rooting since it has the highest possible security impact. In line with our program’s terms of service, we determine bounty amounts based on a variety of factors, including (but not limited to) impact, ease of exploitation, and quality of the report. If a researcher demonstrates in a bug submission that their finding could potentially result in physical health and safety and privacy risks, we’ll also take these examples into consideration when determining the overall bounty payout.

Eligible devices

Meta Quest Pro

Meta Quest Touch Pro Controllers

Meta Quest 2

Meta Quest

Meta Portal TV

Meta Portal+

Meta Portal Go

Meta Portal Mini

Meta Portal

Ray-Ban Stories

Note on Android operating system patches

We will accept missing Android security patch submissions after 6 months following release of the original patch if the impact of the submission falls within one of the accepted vulnerabilities mentioned below.

Payouts

Issues valid on all eligible devices

up to

$30k*

Maximum payouts

Persistent full secure boot bypass

up to

$30k*

Extracting device identity private keys

up to

$20k*

Full exploit chain leading to rooting of the device (chained vulnerabilities will be rewarded separately)

up to

$10k*

Direct access to Meta Quest system-level sensor data (e.g., inward-facing eye- or face- tracking camera views, SLAM cameras)

up to

$10k*

Violation of sensor privacy controls or indicators (e.g., bypass microphone mute, Meta Quest Pro eye-tracking settings toggle, bystander or user facing privacy LEDs)

up to

$10k*

Any unauthorized client-side data access (e.g., secondary user lockscreen bypass, reading files out of /data/data. Payout amount dependent on type of data being accessed)

up to

$10k*

Bugs in one of our drivers operating in the system/root layer except bugs in AOSP itself (payout amount dependent on type of bug)

up to

$5k*

Issues caused by potentially malicious third-party apps (e.g., intent hijacking, accessing sensitive data from system or other apps) (payout amount dependent on type of malicious action)

up to

$5k*

Bypassing the permission model for apps

up to

$3k*

DoS (payout amount dependent on action or service being DoSed)

up to

$3k*

Native bugs

up to

$45k*

“Native bugs” refers to issues unique to languages like C and C++, where memory corruption and mismanagement can lead to information leaks or remote code execution. Base payouts are determined by the amount of user interaction required. User interaction for exploits is commonly measured in “clicks” — the number of actions the victim has to perform to trigger the exploit. For example, no user interaction is 0-click and answering a call or opening a message thread is 1-click.

Remote code execution

These payouts may be lowered if there are other mitigating factors, or the bug is not fully exploitable without another vulnerability. For example, it may require a memory disclosure bug to bypass ASLR.

Maximum payouts

0-Click RCE

up to

$45k*

1-Click RCE

up to

$34k*

2+ Click RCE

up to

$4.5k*

Memory disclosure / info leak

These top payouts are for information leak bugs that leak sensitive user information such as personal information, message contents, or encryption keys.

Maximum payouts

0-Click disclosure of user data

up to

$10k*

1-Click disclosure of user data

up to

$7.5k*

2+ Click disclosure of user data

up to

$1k*

We will adjust the payout with a multiplier based on the type of app:

Root/system service multiplier

First-party high privilege app

0.5x

First-party unprivileged app

0.2x

Third-party app

Out of Scope

Hypothetical bugs and payouts

An issue that would allow a malicious third-party application to inject content that is then consumed by a first-party application, such as pictures to a slideshow or audio to a call, would receive a ~$1,000* payout under the “Issues caused by potentially malicious third-party apps”
A third-party app gaining microphone access without requesting it on a Meta Quest device would receive a $5,000* payout under “Violation of sensor privacy controls or indicators”
A third-party application on a Meta Quest device that is able to crash or disable the Guardian virtual boundary would receive a $3,000* payout under “DoS”
Remote code execution through a buffer overflow in the Meta Quest voice chat library, getting execution in a privileged first-party application would receive a $16,000* payout (1-click exploit in mobile RCE guidelines, 0.5x for multiplier for RCE on first-party high privilege app).
Local device root through heap corruption in a system service would receive a ~$10,000* payout
Remote device root without user interaction through an unprivileged first-party app by exploiting a driver memory corruption bug would receive a ~$19,000* payout (driver memory corruption is 0-click exploit in mobile RCE guidelines, 0.2x for unprivileged first-party app, +$10,000* for rooting the device)