A big month for the Bug Bounty Program
Chromium is enormous – hundreds of millions of lines of code, running on billions of devices, maintained by a global community moving fast enough to ship a new release every two weeks. Finding a real bug in there, understanding why it happens, and landing a fix that doesn’t break something else three modules away, that’s not a weekend project. It’s the kind of work that deserves real money, not just a shoutout.
That’s the whole idea behind the Bug Bounty Program: you put in the hours to track down and fix something that’s been quietly annoying users or developers, and we make it worth your time.
In August, twelve of those fixes landed across rendering, mobile, security, and performance, and the Supporters of Chromium-Based Browsers Foundation paid out $53,000 to the developers who made them happen.
Here’s what got fixed, and why each one mattered more than it might look at first glance.
Web apps that finally look and behave right
- Synced PWAs stuck with the wrong icon. Install a PWA on a new device, and it should look like the app you already know. Instead, some users were stuck staring at a generic placeholder icon indefinitely. The fix retries icon resolution after sync and reconnect, so the real icon shows up like it’s supposed to. (#103)
- PWAs ignoring the phone’s rotation lock. If you had locked your Android device to portrait, an installed PWA using screen.orientation.lock(‘any’) would rotate anyway. The app was silently overriding a setting the user explicitly chose. The fix proposed mapping ‘any’ to the correct orientation mode per the W3C spec, so the OS setting wins like it should. (#106)
Small interaction bugs that added up to real friction
- Datalist clicks that just didn’t register. If a <datalist> popup opened directly under a cursor that hadn’t moved yet, Chrome mistook the click for a drag and ignored it. Tiny bug, maddening in practice, especially since it looked like nothing was wrong until you tried to actually use it. (#105)
- window.innerHeight lying to you mid-keyboard-animation. Any Android web app doing layout math based on viewport height was getting bad numbers the instant the virtual keyboard opened or closed. This one took two separate CLs to fully close out, the kind of bug that looks simple until you’re two layers deep in the animation timing. (#101)
Rendering and web platform correctness
- A layout bug hiding inside min-content measurement. When a soft break opportunity landed right at the start of an open inline tag, Chrome would push that tag’s box decorations onto the wrong line entirely. Subtle enough that it was silently failing web-platform-tests before someone tracked down exactly where the measurement logic went sideways. (#107)
- XML in iframes rendered as stripped plain text. Load an XML document at the top level and Chrome gives you a proper, browsable tree viewer. Load the same document inside an <iframe>, though, and you got flattened, tag-stripped text, a real gap between two paths that should’ve behaved the same. Now fixed, live behind a flag. (#109)
Under the hood
- Trimming the binary, one lookup table at a time. The USB device ID lookup table – data only needed occasionally, for naming connected devices – was being compiled directly into every Chrome binary. It now ships as a resource instead, shaving size off a binary that gets downloaded by billions of devices. Small fix, real-world impact multiplied by scale. (#104)
Get paid to fix Chromium
If you’ve got the skills to go digging into a massive, high-stakes codebase and come back with a real fix, we’ve got the resources to make it worth your while.
Interested in getting paid to fix Chromium? Check out our approved hotlists to find an eligible bug to fix:
- Small bugs: Earn $1,000 for targeted fixes with clear user benefit
- Medium bugs: Earn $5,000 for moderate-impact issues
- Large bugs: Get paid $20,000 for high-impact bugs with broad user or developer visibility
Every bug on this list started the same way: someone noticed something was off, decided to actually dig into it, and stuck with it long enough to land a fix.
That’s genuinely hard work, and it’s exactly the work we want to reward.