Microsoft kicks off two-month Spartan bug bounty program
The temporary award program is very similar to one Microsoft used in mid-2013 for Internet Explorer 11 (IE11) to bag some bugs before that browser was released with Windows 8.1.
"Securing this platform is a top priority for the browser team," said Jason Shirk, a security architect with the Microsoft Security Response Center (MSRC), in a blog post.
Project Spartan is the code name for Microsoft's next browser, which has debuted in unfinished form as part of Windows 10's technical preview. Spartan will be the default browser in Windows 10, replacing IE11 for all but those enterprise customers who need to run legacy Web apps and internal websites.
Microsoft has not yet slapped an official moniker on Spartan, but is expected to do that next week at its Build developers conference. Spartan and Windows 10 will launch this summer, perhaps as early as late July.
"The program is intended to incent security researchers to report vulnerabilities to Microsoft during the Technical Preview period rather than after general use to minimize customer impact," Microsoft explained elsewhere.
Microsoft will pay up to $15,000 for a vulnerability report and functioning exploit, a 36% increase over the $11,000 maximum IE11 bounty. Top awards will be given to what Microsoft dubs "high quality" reports on remote code execution and sandbox escape bugs, with smaller rewards ranging from $500 to $6,000 for less serious flaws. Microsoft reserved the right to pay more than the top-tier $15,000 in special cases.
The company will accept bug reports starting today and ending June 22, a two-month stretch that will be twice the length of the IE11 program.
As in 2013, this year's browser bounties are meant to shake bugs from the researcher trees before Spartan is released to the public. According to Microsoft, the IE11 pre-launch program resulted in engineers patching 18 vulnerabilities prior to the browser's official release.
Microsoft has published guidelines for the Project Spartan Bug Bounty program on its website.