Microsoft announced on Thursday that it’s offering up to $15,000 to researchers who find remote code execution vulnerabilities in the company’s Edge web browser running on Windows Insider Preview builds.
Users who sign up for the Windows Insider program are given the chance to test new features before they are made generally available. Microsoft wants white hat hackers to find remote code execution (RCE) flaws in Edge on Windows preview builds and it’s prepared to pay out between $500 and $15,000.
Microsoft is aware that some of the vulnerability reports it will receive as part of this program will describe issues that its employees are already working to address, but the company says it will still pay up to $1,500 to the first external researcher who finds a bug that is in the process of being fixed.
The company also noted that the bug bounty program includes the open source sections of Chakra, the JavaScript engine that powers Edge. The program will end on May 15, 2017.
“This bounty continues our partnership with the security research community in working to secure our platforms, in pre-release stages of the development process,” Microsoft said.
The tech giant runs several bug bounty programs, including for its online services, Nano Server, .NET and ASP.NET core, and mitigation bypasses. While the top reward in most cases is $15,000, the company is prepared to offer up to $100,000 for new exploitation techniques that target the protections built into Windows. Researchers can double the amount if the mitigation bypass is accompanied by an idea on how to defend against the attack.
Related: New Windows Attack Turns Evil Maid into Malicious Butler
Related: Microsoft Expands Bug Bounty Program
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
- Meta Awards $27,000 Bounty for 2FA Bypass Vulnerability
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Hive Ransomware Operation Shut Down by Law Enforcement
- UK Gov Warns of Phishing Attacks Launched by Iranian, Russian Cyberspies
- Dozens of Cybersecurity Companies Announced Layoffs in Past Year
- Security Update for Chrome 109 Patches 6 Vulnerabilities
Latest News
- Russian Millionaire on Trial in Hack, Insider Trade Scheme
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
- Vulnerabilities in OpenEMR Healthcare Software Expose Patient Data
- Russia-Linked APT29 Uses New Malware in Embassy Attacks
- Meta Awards $27,000 Bounty for 2FA Bypass Vulnerability
- The Effect of Cybersecurity Layoffs on Cybersecurity Recruitment
- Critical Vulnerability Impacts Over 120 Lexmark Printers
- BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws
