Apple Security Bounty features the industry’s highest rewards for exploit chains that can achieve similar goals as sophisticated mercenary-spyware attacks. Rewards are determined by the outcomes you’re able to demonstrate with your report.
Obtaining a specific reward requires confirmation with Target Flags where indicated. We provide bonus rewards for the most exceptional research, including vulnerabilities that bypass the specific protections of Lockdown Mode or are discovered in beta software.
| Entry Point / End Point / Maximum Reward | |
|---|---|
Network attack with no user interaction
| |
Network attack with user interaction
| |
Wireless proximity-based attacks targeting Apple-designed radio components
| |
Unauthorized physical device access
| |
App sandbox escape
| |
Browser attack
| |
| Entry Point | End Point / Maximum Reward | ||
|---|---|---|---|
| Network attack with no user interaction |
| ||
| Network attack with user interaction |
| ||
| Wireless proximity-based attacks targeting Apple-designed radio components |
| ||
| Unauthorized physical device access |
| ||
| App sandbox escape |
| ||
| Browser attack |
| ||
| Entry Point | End Point | Maximum Reward | |
|---|---|---|---|
| Network attack with no user interaction | Kernel | $2,000,000 | |
A qualifying submission starts with an identifier associated with a device, such as a phone number or an email address, and obtains a level of kernel control over the device without requiring any user interaction. Examples | |||
| User space | $350,000 | ||
A qualifying submission starts with an identifier associated with a device, such as a phone number or an email address, and obtains a level of user space control over the device without requiring any user interaction. Examples | |||
| Network attack with user interaction | Kernel | $1,000,000 | |
A qualifying submission starts with an identifier associated with a device, such as a phone number or an email address, and after interaction from the user, obtains a level of kernel control over the device. Examples | |||
| Wireless proximity-based attacks targeting Apple-designed radio components | Application processor | $1,000,000 | |
A qualifying submission starts with sending malicious data to an Apple-designed device radio from physical proximity and obtains a level of control over the device’s application processor without requiring any user interaction. Examples | |||
| Unauthorized physical device access | Access to sensitive user data | $500,000 | |
A qualifying submission starts with physical access to a locked Apple device and obtains sensitive user data from that device. Examples | |||
| App sandbox escape | Kernel | $500,000 | |
A qualifying submission starts with running a malicious app on iPhone and obtains a privileged level of control over the device. Examples | |||
| Access to sensitive user data | $100,000 | ||
A qualifying submission starts with running a malicious app on iPhone and obtains sensitive user data from that device. Examples | |||
| Browser attack | Kernel | $1,000,000 | |
A qualifying submission starts by navigating to a malicious webpage in Safari and obtains a level of kernel control on the device. Examples | |||
| WebContent sandbox escape | $300,000 | ||
A qualifying submission starts by navigating to a malicious webpage in Safari and obtains a privileged level of user space control on the device. Examples | |||
| Web Content code execution | $10,000 | ||
A qualifying submission starts by navigating to a malicious webpage in Safari and obtains code execution within the WebContent process. Examples | |||
| Topic / Description / Maximum Reward | |
|---|---|
Unauthorized access to iCloud account data on Apple servers
| |
Remote Code Execution
| |
Unrestricted file system or database access
| |
Logic flaw bugs leaking or bypassing significant security controls
| |
Code execution on the client/server
| |
Confidential or sensitive data
| |
Domain and subdomain takeovers
| |
| Topic | Description / Maximum Reward | ||
|---|---|---|---|
| Unauthorized access to iCloud account data on Apple servers |
| ||
| Remote Code Execution |
| ||
| Unrestricted file system or database access |
| ||
| Logic flaw bugs leaking or bypassing significant security controls |
| ||
| Code execution on the client/server |
| ||
| Confidential or sensitive data |
| ||
| Domain and subdomain takeovers |
| ||
| Topic | Description | Maximum Reward | |
|---|---|---|---|
| Unauthorized access to iCloud account data on Apple servers | Access to iCloud data on Apple servers without authorization | $1,000,000 | |
Examples | |||
| Remote Code Execution | Command injection, deserialization bugs, XXE leading to RCE | $100,000 | |
Examples | |||
| Unrestricted file system or database access | Unsandboxed XXE, SQL injection | $50,000 | |
Category Description: A qualifying submission starts with an identifier associated with a device, such as a phone number or an e-mail address, and obtains a level of control over the device without requiring any user interaction. • ($2M) Unsigned code execution with arbitrary entitlements. For example, an attack delivered via RCS... Examples | |||
| Logic flaw bugs leaking or bypassing significant security controls | Direct object reference, remote user impersonation, account takeover, privilege escalation, IDOR, SSRF, directory traversal, HTTP-request smuggling, proxy misconfiguration leading to bypass of security controls | $50,000 | |
Examples | |||
| Code execution on the client/server | XSS, CSRF, HTML injection or having write-access authorization when prohibited | $40,000 | |
Examples | |||
| Confidential or sensitive data | Generalized access control issues leading to exposure of PII | $30,000 | |
Examples | |||
| Domain and subdomain takeovers | DNS zone, domain, and subdomain takeovers | $5,000 | |
Examples | |||
⚑ Target Flag is required to receive the stated reward.
macOS rewards
Additional Apple Security Bounty rewards for reports that affect only macOS:
- A complete bypass of Gatekeeper quarantined file checks that requires only standard user interaction to open a downloaded app is eligible for a $100,000 reward. To be eligible for the maximum reward, the app must have been downloaded by Safari, have the quarantine bit applied, and bypass Gatekeeper checks when opened.
- Reports that involve limited user interaction to bypass Gatekeeper, including common installer flows such as dragging an app to the Applications folder, are eligible for up to $10,000.
- A capture of the TCC Target Flag is eligible for a $5,000 reward if it uses an unsandboxed app, and a $10,000 reward if it also escapes the App Sandbox. A report that obtains sensitive data protected by TCC, such as Photos, but does not use the TCC Target Flag, is eligible for a $1,000 reward.
- A sandbox escape that is demonstrated only against macOS is eligible for a $5,000 reward.
Private Cloud Compute (PCC) rewards
- A remote attack on request data, ultimately allowing unsigned code execution with arbitrary entitlements within the Apple PCC software image, is eligible for a $1,000,000 reward. A remote attack on request data which instead obtains access to a user's request data, or to sensitive information about the user's requests outside the trust boundary, is eligible for a $250,000 reward.
- Attacks which require a privileged network position are also eligible for rewards. With this precondition, access to a user's request data, or other sensitive information about the user outside the trust boundary, is eligible for a $150,000 reward, and the ability to execute unattested code in the Apple PCC software stack is eligible for a $100,000 reward.
- Reports which rely on accidental or unexpected data disclosure due to deployment or configuration issues within Apple PCC are eligible for a $50,000 reward.
Bonus rewards
| Topic | Additional Bonus |
|---|---|
| Beta software: Issues that are unique to newly added features or code in developer and public beta releases, including regressions | 50% |
| Lockdown Mode: Issues that bypass the specific protections of Lockdown Mode | 100% |
| Beta software + Lockdown Mode | 150% |
Topic
Beta software: Issues that are unique to newly added features or code in developer and public beta releases, including regressions
| Additional Bonus |
|---|
| 50% |
Topic
Lockdown Mode: Issues that bypass the specific protections of Lockdown Mode
| Additional Bonus |
|---|
| 100% |
Topic
Beta software + Lockdown Mode
| Additional Bonus |
|---|
| 150% |
Note: At our sole discretion, Apple may award an additional bonus for the most exceptional and novel research that we receive.
Considering donating your reward? Apple doubles Apple Security Bounty rewards when donated to qualifying causes — like the Ford Foundation’s Dignity and Justice Fund, which helps combat mercenary spyware.