I'm not big into the security game/community, but I really don't understand the logic of "don't divulge how you break out of the sandbox = more exploits get fixed". And I did read the source link and try to understand...
There is also the fact that anyone in the industry can make a few phone calls and have a bidding war on this type of exploit that will go well into the 6 figures, possibly as high as 7 according to some. $1M sounds high to me personally, but there is no doubt that it will fetch a few hundred thousand.
To my knowledge, the US government is the biggest buyer of unpublished exploits. And they pay a lot more than 60k. One well-known US-based company is even run by a former NSA employee, and they're currently advertising a remote pre-authentication exploit in the latest version of MySQL.
It is also worth noting that breaking into the computer of a foreign national that is located overseas is often not a crime in the united states, or is at least considered very difficult to prosecute if it doesn't involve fraud, financial transfers or a few other hot buttons.
This isn't new, security companies have been paying contractors for unpublished advisories and exploits for over 15 years now.
Selling exploits on the black/grey market is and will always be fast money, and a bad idea.
Pwnium is just there to lower those prices, at least attempt to.
This one exploit is there to be able to say "see, we get those for 60K, why would we pay you 500K"?
When it comes to vulnerabilities affecting modern day
browsers, there are two main categories: code execution
and post-exploitation bypasses (sandbox escapes).
[...]
Without one of these, the second type of vulnerability is
neutered.
i.e. if someone reports a working exploit for Chrome, but doesn't tell how, Google has no choice but to investigate as deeply as it can and root out any possibility it can think of, and perhaps do automated checks in all of the source where it could possibly happen.
If you instead point out it's a buffer overrun in file x.c, they'll likely just patch up that one file.