Meta Paid Out $4 Million via Bug Bounty Program in 2025

Meta has paid out $4 million through its bug bounty programme in 2025, bringing the total awarded since the programme’s creation to more than $25 million, according to SecurityWeek. The company says it received roughly 13,000 vulnerability reports this year, with about 800 of them rewarded. Three reports were highlighted by Meta, including one that referred to CVE-2025-59489, a Unity vulnerability that prompted action from Microsoft and Steam.

Another report described by researchers from the University of Vienna details a method for enumerating WhatsApp accounts at scale, while a separate bug report targeting WhatsApp came from a Meta analyst about incomplete validation that could have exploited processing of content from an arbitrary URL on a user’s device.

Meta notes WhatsApp clients and server infrastructure are important targets, and it has developed a tool called WhatsApp Research Proxy to aid in researching WhatsApp-specific technologies, currently available to a limited group of bug bounty hunters.