Maybe that's a little farfetched, though.
Maybe that's a little farfetched, though.
Not a perfect fix, but I think it helps.
One potential issue: someone on the Mozilla team could pass some of these on to a few friends who then claim some of the money.
It's not a major likelihood, unless the bounties are numerous or especially large.
So long as there is a big of lag before confirmation (which, in practice, there already is), the vendor would know about the issue at least several days in advance of the black-hat even getting a hint and could hopefully patch it in that time.
For especially big holes, just take a bit longer than usual to get back to people until it's fixed.
Another scenario is someone does what you suggest after finding a real vulnerability, to waste the teams time while they exploit the real vulnerability.