Categories - Apple Security Research
Apple Security Research
Local Nav Open Menu
Overview
Blog
Bounty
Research Device
Submit a Report
Apple Security Bounty Categories
Apple Security Bounty features the industry’s highest rewards for exploit chains that can achieve similar goals as sophisticated mercenary-spyware attacks. Rewards are determined by the outcomes you’re able to demonstrate with your report.
Obtaining a specific reward requires confirmation with Target Flags where indicated. We provide bonus rewards for the most exceptional research, including vulnerabilities that bypass the specific protections of Lockdown Mode or are discovered in beta software.
Products
Services
Entry Point / End Point /
Maximum RewardView ExamplesexamplesNetwork attack with no user interaction
Kernel
$2,000,000
User space
$350,000Network attack with user interaction
Kernel
$1,000,000Wireless proximity-based attacks targeting Apple-designed radio components
Application processor
$1,000,000Unauthorized physical device access
Access to sensitive user data
$500,000App sandbox escape
Kernel
$500,000
Access to sensitive user data
$100,000Browser attack
Kernel
$1,000,000
WebContent sandbox escape
$300,000
Web Content code execution
$10,000Entry PointEnd Point / Maximum RewardView ExamplesexamplesNetwork attack with no user interaction
Kernel
$2,000,000
User space
$350,000Network attack with user interaction
Kernel
$1,000,000Wireless proximity-based attacks targeting Apple-designed radio components
Application processor
$1,000,000Unauthorized physical device access
Access to sensitive user data
$500,000App sandbox escape
Kernel
$500,000
Access to sensitive user data
$100,000Browser attack
Kernel
$1,000,000
WebContent sandbox escape
$300,000
Web Content code execution
$10,000Entry PointEnd PointMaximum RewardView Examples examplesNetwork attack with no user interactionKernel$2,000,000
A qualifying submission starts with an identifier associated with a device, such as a phone number or an email address, and obtains a level of kernel control over the device without requiring any user interaction.ExamplesUser space$350,000
A qualifying submission starts with an identifier associated with a device, such as a phone number or an email address, and obtains a level of user space control over the device without requiring any user interaction.ExamplesNetwork attack with user interactionKernel$1,000,000
A qualifying submission starts with an identifier associated with a device, such as a phone number or an email address, and after interaction from the user, obtains a level of kernel control over the device.ExamplesWireless proximity-based attacks targeting Apple-designed radio components Application processor $1,000,000
A qualifying submission starts with sending malicious data to an Apple-designed device radio from physical proximity and obtains a level of control over the device’s application processor without requiring any user interaction.ExamplesUnauthorized physical device access Access to sensitive user data$500,000
A qualifying submission starts with physical access to a locked Apple device and obtains sensitive user data from that device.ExamplesApp sandbox escapeKernel$500,000
A qualifying submission starts with running a malicious app on iPhone and obtains a privileged level of control over the device.ExamplesAccess to sensitive user data$100,000
A qualifying submission starts with running a malicious app on iPhone and obtains sensitive user data from that device.ExamplesBrowser attackKernel$1,000,000
A qualifying submission starts by navigating to a malicious webpage in Safari and obtains a level of kernel control on the device.ExamplesWebContent sandbox escape$300,000
A qualifying submission starts by navigating to a malicious webpage in Safari and obtains a privileged level of user space control on the device.ExamplesWeb Content code execution$10,000
A qualifying submission starts by navigating to a malicious webpage in Safari and obtains code execution within the WebContent process.Examples
Topic / Description /
Maximum RewardView ExamplesexamplesUnauthorized access to iCloud account data on Apple servers
Access to iCloud data on Apple servers without authorization
$1,000,000Remote Code Execution
Command injection, deserialization bugs, XXE leading to RCE
$100,000Unrestricted file system or database access
Unsandboxed XXE, SQL injection
$50,000Logic flaw bugs leaking or bypassing significant security controls
Direct object reference, remote user impersonation, account takeover, privilege escalation, IDOR, SSRF, directory traversal, HTTP-request smuggling, proxy misconfiguration leading to bypass of security controls
$50,000Code execution on the client/server
XSS, CSRF, HTML injection or having write-access authorization when prohibited
$40,000Confidential or sensitive data
Generalized access control issues leading to exposure of PII
$30,000Domain and subdomain takeovers
DNS zone, domain, and subdomain takeovers
$5,000TopicDescription / Maximum RewardView ExamplesexamplesUnauthorized access to iCloud account data on Apple servers
Access to iCloud data on Apple servers without authorization
$1,000,000Remote Code Execution
Command injection, deserialization bugs, XXE leading to RCE
$100,000Unrestricted file system or database access
Unsandboxed XXE, SQL injection
$50,000Logic flaw bugs leaking or bypassing significant security controls
Direct object reference, remote user impersonation, account takeover, privilege escalation, IDOR, SSRF, directory traversal, HTTP-request smuggling, proxy misconfiguration leading to bypass of security controls
$50,000Code execution on the client/server
XSS, CSRF, HTML injection or having write-access authorization when prohibited
$40,000Confidential or sensitive data
Generalized access control issues leading to exposure of PII
$30,000Domain and subdomain takeovers
DNS zone, domain, and subdomain takeovers
$5,000TopicDescriptionMaximum RewardView Examples examplesUnauthorized access to iCloud account data on Apple serversAccess to iCloud data on Apple servers without authorization$1,000,000
ExamplesRemote Code ExecutionCommand injection, deserialization bugs, XXE leading to RCE$100,000
ExamplesUnrestricted file system or database accessUnsandboxed XXE, SQL injection$50,000
Category Description: A qualifying submission starts with an identifier associated with a device, such as a phone number or an e-mail address, and obtains a level of control over the device without requiring any user interaction.
• ($2M) Unsigned code execution with arbitrary entitlements. For example, an attack delivered via RCS...ExamplesLogic flaw bugs leaking or bypassing significant security controlsDirect object reference, remote user impersonation, account takeover, privilege escalation, IDOR, SSRF, directory traversal, HTTP-request smuggling, proxy misconfiguration leading to bypass of security controls$50,000
ExamplesCode execution on the client/serverXSS, CSRF, HTML injection or having write-access authorization when prohibited$40,000
ExamplesConfidential or sensitive dataGeneralized access control issues leading to exposure of PII$30,000
ExamplesDomain and subdomain takeoversDNS zone, domain, and subdomain takeovers$5,000
Examples
⚑ Target Flag is required to receive the stated reward.
macOS rewards
Additional Apple Security Bounty rewards for reports that affect only macOS:
A complete bypass of Gatekeeper quarantined file checks that requires only standard user interaction to open a downloaded app is eligible for a $100,000 reward. To be eligible for the maximum reward, the app must have been downloaded by Safari, have the quarantine bit applied, and bypass Gatekeeper checks when opened.
Reports that involve limited user interaction to bypass Gatekeeper, including common installer flows such as dragging an app to the Applications folder, are eligible for up to $10,000.
A capture of the TCC Target Flag is eligible for a $5,000 reward if it uses an unsandboxed app, and a $10,000 reward if it also escapes the App Sandbox. A report that obtains sensitive data protected by TCC, such as Photos, but does not use the TCC Target Flag, is eligible for a $1,000 reward.
A sandbox escape that is demonstrated only against macOS is eligible for a $5,000 reward.
Private Cloud Compute (PCC) rewards
A remote attack on request data, ultimately allowing unsigned code execution with arbitrary entitlements within the Apple PCC software image, is eligible for a $1,000,000 reward. A remote attack on request data which instead obtains access to a user's request data, or to sensitive information about the user's requests outside the trust boundary, is eligible for a $250,000 reward.
Attacks which require a privileged network position are also eligible for rewards. With this precondition, access to a user's request data, or other sensitive information about the user outside the trust boundary, is eligible for a $150,000 reward, and the ability to execute unattested code in the Apple PCC software stack is eligible for a $100,000 reward.
Reports which rely on accidental or unexpected data disclosure due to deployment or configuration issues within Apple PCC are eligible for a $50,000 reward.
Bonus rewardsTopicAdditional BonusBeta software: Issues that are unique to newly added features or code in developer and public beta releases, including regressions50%Lockdown Mode: Issues that bypass the specific protections of Lockdown Mode100%Beta software + Lockdown Mode150%
Topic
Beta software: Issues that are unique to newly added features or code in developer and public beta releases, including regressionsAdditional Bonus50%
Topic
Lockdown Mode: Issues that bypass the specific protections of Lockdown ModeAdditional Bonus100%
Topic
Beta software + Lockdown ModeAdditional Bonus150%
Note: At our sole discretion, Apple may award an additional bonus for the most exceptional and novel research that we receive.
Give your work an even greater purpose.
Considering donating your reward? Apple doubles Apple Security Bounty rewards when donated to qualifying causes — like the Ford Foundation’s Dignity and Justice Fund, which helps combat mercenary spyware.
Apple Security BountyLearn more
Terms and
ConditionsLearn more
Apple FooterApple Security Research
Bounty
Categories
Copyright © 2026 Apple Inc. All rights reserved.
SupportApple Platform SecurityPrivacy PolicyLegal
Copyright © 2026 Apple Inc. All rights reserved.