Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Reflected Cross Site Scripting (XSS)#435144	Informative	Cross-site Scripting	Medium	2019-04-30	–	11
Can register any mobile number in MFA without current code.Analysed#667740	Valid	Access Control	Low	2019-08-15	–	15
Emails from Grammarly missing sanitization(lack of validation?) -> HTML injection in emails#404864	Duplicate	Misconfiguration and Insecure Design	Low	2019-04-30	–	22
"More on Wikipedia" link disclose "Referrer" and leak `window.opener` reference for arbitrary websitesAnalysed#409518	Valid	Misconfiguration and Insecure Design	Low	2019-04-30	–	29
Permissive CORS policy trusting arbitrary extensions originAnalysed#412490	Valid	Access Control	Medium	2019-11-06	$500	33
`open-url` command allows opening unlimited number of tabs pointing to arbitrary URLsAnalysed#389076	Valid	No weakness recorded	Medium	2019-04-23	–	37
DOM based CSS Injection on grammarly.comAnalysed#500436	Valid	Cross-site Scripting	Low	2019-05-06	$250	63
“email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expiredAnalysed#665722	Valid	Authentication	Medium	2019-08-12	$2,500	82
Grammarly Keyboard for Android <4.1 leaks user input through logs (except for sensitive input fields)Analysed#462416	Valid	Information Disclosure	Low	2019-06-03	–	84
`socket` command allows sending data over WebSockets to arbitrary origins from Grammarly ExtensionAnalysed#395729	Valid	No weakness recorded	High	2019-07-15	–	140
Lack of CSRF header validation at https://g-mail.grammarly.com/profileAnalysed#629892	Valid	Information Disclosure	Medium	2019-10-31	–	140
Previously created sessions continue being valid after MFA activationAnalysed#667739	Valid	Access Control	Medium	2019-08-19	–	176
Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's originAnalysed#389108	Valid	No weakness recorded	Critical	2019-08-01	–	202
Account takeover through the combination of cookie manipulation and XSSAnalysed#534450	Valid	Cross-site Scripting	High	2019-12-03	–	292
Employee's GitHub Token Found In Travis CI Build LogsAnalysed#496937	Valid	Information Disclosure	High	2019-05-22	$5,000	408

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.