Google Mobile VRP Engineer Explains Android Bug Report Triage

Summary

A Google Mobile VRP engineer explains how Android app reports are triaged, assessed and rewarded, highlighting reproducible proof-of-concepts, program scope, common permission and intent bugs, and how user interaction affects impact.

Key points

Valid reports are initially triaged and may go to a specialist panel, typically involving several security engineers, to review the bug and determine a reward.
Reports are easier to assess when they clearly explain the issue and include a reproducible proof-of-concept that works on the latest Android version.
For some bugs, a simple ADB command can demonstrate the issue. If researchers submit an APK, including its source helps Google reproduce it without running an unexplained binary.
Google Mobile VRP tiers first-party apps: tier one covers specified high-value apps, tier two covers apps that interact with tier-one apps, and tier three covers others. Android platform issues generally fall under Android VRP.
The engineer identifies intent redirection, authentication or authorization issues, and permission bypasses as common findings; permission-related edge cases can also create serious bugs.
Sideload-dependent issues may qualify, but the required user interaction can lower their impact. Vulnerabilities requiring less interaction, or triggered remotely, are generally assessed as higher impact.
The panel assesses demonstrated impact, and may ask researchers to investigate further when a report appears to have greater potential impact.

Article Details

Topics: [00:14] Google Mobile VRP and Android app bug bounty responsibilities
[01:40] Report triage, panel review, validation and reward decisions
[03:09] What makes an actionable vulnerability report and proof-of-concept
[06:13] Android PoC formats, APK source and ADB-based reproduction
[08:41] Mobile VRP scope, app tiers and Android Open Source Project coverage
[11:36] Common Android vulnerabilities: intent redirection and permission flaws
[13:08] Sideloading, user interaction and vulnerability impact tiers
[20:53] Demonstrated impact and reward assessment

People

FabianLiveOverflow host and Hextree co-founder; he interviews Google's Mobile VRP engineer about Android bug bounty operations and security education.

Vendors

GoogleGoogle operates the Mobile VRP for Android applications; its security engineers triage reports and assess findings and rewards.

Products

AndroidAndroid is the platform whose applications and vulnerabilities are covered by the Mobile VRP and discussed throughout the interview.