Google has launched a bug bounty , but this time it is not only aimed at its own applications, but also at those developed by third-party companies and published on the Play Store.
Google's new effort is called the Play Security Reward Program and it invites hackers to identify remote code execution (RCE) flaws in certain popular Android apps running on Android 4.4 and later.
Currently, only eight different developers have been approved for the program, including Alibaba, Dropbox, Duolingo, Headspace, Line, Mail.ru, Snapchat, and Tinder, but Google says it is working with more app makers to expand the program.
Although Google apps are also part of the new bug bounty program, the company explains that submissions must include proof of concept and demonstrate how an attacker can gain full control of a device. Bypassing the OS sandbox is not a requirement.
The winner of the program will be rewarded with $1,000 and according to reports, researchers must work with app developers to resolve the vulnerability. If the bug is successfully fixed, the Android security team will offer a reward to the researcher.
This program will not only benefit developers and applications but also the entire Android ecosystem.
Google plans to expand the program to cover even more vulnerabilities and recommends that developers who have not yet participated contact a Google Play partner to learn how they can add their apps to the Play Security Reward Program.
