Mobile Malware · Detection & Defense · Lesson 4 of 5

Responsible Disclosure

Learn how researchers report flaws, how fixes get tracked and where careers start.

Reporting a flaw

Every patch you read about in this course started with someone finding a flaw. Sometimes it's the vendor's own team. Often it's an outside security researcher, who then faces a choice about what to do with that knowledge.

The responsible path is coordinated disclosure: report the flaw privately to the vendor, give them time to fix it, and only then publish the details. Big vendors make this easy, and pay for it, through bug bounty programs, which reward researchers for valid reports.

• Apple Security Bounty covers iOS, macOS and Apple's other platforms. Apple says it has paid over $35 million to more than 800 researchers since opening the program to the public in 2020. In late 2025 it raised its top award to $2 million for a zero-click attack chain, with bonuses (for example, for bypassing Lockdown Mode protections) that can push a payout above $5 million.
• Android and Google Devices Security Reward Program covers Android itself and Google's own hardware such as Pixel phones.
• Google Mobile Vulnerability Reward Program covers Google's Android apps, such as Gmail and Chrome.

Both companies run these through official pages (security.apple.com and bughunters.google.com) with clear rules about scope and what counts.

Once a flaw is confirmed, it usually gets a CVE ID (Common Vulnerabilities and Exposures), a public label like CVE-2021-30860. That one is the FORCEDENTRY flaw from iOS Internals, fixed in iOS 14.8. The CVE Program is run by MITRE with sponsorship from the US Cybersecurity and Infrastructure Security Agency (CISA). Most IDs are assigned by CVE Numbering Authorities (CNAs), organizations such as Apple and Google that can number flaws in their own products.

Why does a shared label matter? A phone maker reading Google's bulletin, an MTD vendor writing a detection and an IT team checking its fleet can all refer to exactly the same flaw. A CVE ID names a flaw. It isn't proof that anyone has attacked it, and it isn't a severity score on its own.

Deadlines, patches and careers

Coordinated disclosure needs a deadline, or a slow vendor could leave a flaw unfixed for years. The best-known policy belongs to Project Zero, Google's team that hunts flaws in many companies' software, including Apple's and Google's own.

• The vendor gets 90 days from the report to make a fix available.
• If it's fixed in time, details are published 30 days after the patch, so people have time to update.
• If the flaw is already being exploited against real people, the deadline shrinks to 7 days.
• Small grace periods are possible on request.

In July 2025 Project Zero also began a trial called Reporting Transparency. About a week after a report, it publicly lists the vendor, the product and the deadline date, but no technical details.

Why don't responsible researchers just publish everything right away? Because a working exploit released before a patch helps attackers more than defenders. Defenders can't fix a phone that has no update yet, while criminals can copy the attack within hours. Even after a patch, many phones take weeks or months to update, which is why that 30-day gap exists. Researchers do eventually publish detailed write-ups, and those help others find similar bugs and build better detections.

One line matters above all: research only on systems you own or have permission to test, and stay inside a program's written scope. Breaking into other people's phones isn't research, whatever the motive.

If this track has caught your interest, there are several paths in mobile security:

• Malware analyst, taking apart samples in a lab, as you did in this track.
• Mobile app penetration tester, checking apps for flaws before release. The OWASP MASTG and MASVS are the standard guides.
• Vulnerability researcher, hunting OS and app bugs, often through bounty programs.
• Threat intelligence analyst, tracking campaigns and writing indicator reports.
• Mobile security engineer, running MDM, MTD and incident response at a company.

Capture-the-flag events, practice apps built to be broken and public write-ups are good places to start.