Hacker News Reader

Comment by landr0id | Hacker News Reader

Exploit prices and complexity usually accurately reflect the security of a product when compared to their competitors. Take a look at how much Zerodium pays for full-chain exploits here: https://zerodium.com/program.html

  $250,000 - Chrome RCE + SBX (Windows) including a sandbox escape (previously: $150,000)

Whereas it's up to $100k for Edge RCE+SBX, $80k for Firefox RCE+SBX

You obviously need to factor in other things such as how popular the product is compared to competitors, etc., but such a drastic price difference such as this is quite telling.

View on HN

You have a valid point but you are using misleading data: Don't compare a RCE + SBX vs a RCE w/o SBX. Firefox RCE + SBX is 80k, edge is 100k, safari is also 80k.

Another thing to take in consideration is the number of people that the exploit could be used against. For example, following this: http://gs.statcounter.com/browser-market-share/desktop/world..., Chrome would have almost 68% of the browsing share whereas Firefox is only close to 10% and all the others even less. It'd be surprising this isn't taken account by Zerodium in their price calculations!

You're correct -- I was referring to the table that was easiest to quickly reference which is the changelog, not ALL current prices. The periodic table is more accurate. I'll update my post.

Adding to this comment, see prices for 2018's Pwn2Own contest [1], for which Google Chrome has a 50% premium over Firefox and Safari. The Chromium bug bounty [2] is also the most accessible in terms of documentation and requirements; likewise it has the lowest floor and highest ceiling on potential payouts.

______________________

1. https://www.zerodayinitiative.com/Pwn2Own2018Rules.html

2. https://www.google.com/about/appsecurity/chrome-rewards/

Reply on news.ycombinator.com