Hi everyone, I’m an independent security researcher looking for an outside perspective on the handling of an Android security vulnerability. The report was accepted, subsequently fixed by the vendor, and rewarded. However, I believe the original Low severity assessment may not have fully reflected the demonstrated security impact. The issue involved a third-party content-delivery prerequisite combined with an application-controlled native WebView trust boundary. The original evidence demonstrated access to privileged application functionality and authenticated own-account capabilities. My proposed CVSS v3.1 assessment was 7.1 (High), while the vendor classified the issue as Low, placing significant weight on the local-app prerequisite and third-party dependency. I recognize that CVSS severity and bug-bounty reward decisions are not necessarily identical. I also acknowledge that I accepted the original payment and withdrew an earlier request to reconsider its amount. I am not claiming that an agreed payment remains outstanding. I’m now seeking an independent technical and procedural review. I’d appreciate community opinions on three questions: How should a vendor-controlled trust boundary be evaluated when the initial content-delivery condition belongs to a third-party integration? Is a Low classification necessarily appropriate where exploitation requires a co-installed application but authenticated-session impact has been demonstrated? Is it reasonable to request a post-payment independent severity review and potential discretionary supplemental reward? I am withholding exploit details and private disclosure materials while confirming the applicable disclosure restrictions. I would appreciate technical reasoning and experience with similar bug-bounty triage situations. Thank you 1 post - 1 participant Read full topic