Article Lead Image

Photo via reynermedia

Hacker scores $5,000 payday for finding address bar flaw in Chrome and Firefox

Developers can't find every bug themselves, so they use bug bounties to encourage hackers to help them keep programs secure.


John-Michael Bond


Posted on Aug 16, 2016   Updated on May 26, 2021, 6:17 am CDT

While developers do their best to ensure the programs and apps they make are secure when they’re released, it’s often impossible for a team to find every bug. That’s why bug bounties exist, as a way to reward users who help developers find security flaws in the programs we use every day. It’s also why Rafay Baloch is currently $5,000 richer.

Baloch recently discovered a vulnerability in the way Chrome and Firefox render website addresses, which allowed attackers to send users to spoof websites that appear to be real but are actually elaborate frauds. The vulnerability was caused by the browser’s flipping of web addresses that are written right-to-left, since that’s how some languages, such as Arabic, are read.

According to Baloch’s example, if a user were to input, the browser would display it as simply, while still sending the user to This allowed scam artists to trick users to visiting spoof sites that use the guise of official domains.

According to Baloch the issue will be resolved when Chrome 53 and Firefox 48 are released. In the meantime let Baloch’s windfall be your inspiration. If you’ve got the skill to discover a bug it could pay off in more than just a pat on the back for making the world a better place. It could land you cold hard cash.


Share this article
*First Published: Aug 16, 2016, 11:01 am CDT