The Chrome VRP Panel has decided to award $250k for this report

Honestly I’d be more worried about crossing the blackhats.

...come to think of it, how does that work? Aren't the most important exploits to patch the ones being actively used in the wild?

In other words, how do they avoid someone playing both sides? "I found an exploit being used by the LEETH4X0R malware [which was in fact created by the guy I sold this exploit to] to steal people's gmail cookies."

You'd have to find out about LEETH4X0R before other researchers, but of course, you'd have a head start.

And yeah if you want normal stuff like a house or car you'd need to wash the money. How do I know? Breaking Bad. Which lets be honest is probably for most of us, our only reference point here.

They also have every incentive to make sure you're guilty enough to not go blab to the authorities later, or sell it to someone else.

And since you're trying to be anonymous in this, you aren't going to be getting a regular tax receipt either.

https://www.irs.gov/publications/p525#en_US_2024_publink1000...

>Illegal activities.

>Income from illegal activities, such as money from dealing illegal drugs, must be included in your income on Schedule 1 (Form 1040), line 8z, or on Schedule C (Form 1040) if from your self-employment activity.

How much of a premium are they paying to make it worthwhile?

Yes, maybe the exploit could likely be modified to be more reliable. That's more work though.

That makes me wonder - may be the original bug was really a backdoor created as a result of a deal with an intelligence agency/vendor. So, can it be that Google gets money (or more generally some kind of browny points; also interesting aspect - giving that the agencies may exploit individual engineers, it would seem to be more preferable for the company to play ball and have it organized under the company's control) for a backdoor, and once backdoor is found - pays the bug bounty. The bug bounty is thus a kind of backdoor quality control program :)

In that light, what others would do is rarely a reliable indicator that you shouldn’t think twice about your actions, lest you regret later, once the thinking has happened.

That is why you see equivalent skill levels being paid differently in big tech compared to other places.

And why you see millions in salaries at some big techs Ai hiring.

It's really no secret that higher revenue means higher potential pay/more devs...

Surely a bug on Chrome is worth more than a bug on Firefox.

Maybe had they ran the company competently, they could to afford to pay their engineers and offer larger bounties instead.

> Is monetary expenditure on vulnerability payouts really the primary determinent of who's taking security more seriously.

Many such researchers would rather sell their 0day to the black market if the effort + price offered is too low and not worth it. It is up to the vendor (Mozilla) to set a fair price to prevent that exploit from reaching the black market for a much higher price.

So given all the above, Mozilla is not serious.

Once you're thinking along the lines of "Alright, if I had some order of flags, I could solve that thing over there. If I knew some kind of weights, I could solve that over there. And if I could find a light bulb I could deal with that over there", you're kinda in the mindset of finding an exploitation chain.

It's just that in the security world, it's more about bad memory accesses, confusing programs into doing the right actions with wrong files, file permissions being weird and such.

Edit: just wanted to riff on your analogy. It is relatively simple to crash/shoot down a rocket, but this exploit gets into the control room and could allow the attacker to see where all other rockets are going & maybe redirect/crash them.

Because neither of those are going to change your daily life that much? It simplifies a thing or two, but neither of those things are life-changing.

I have a hard time seeing it as life changing for me, having a decent paying job (not silicon valley developer scale) in a expensive country. Ofc if I was having a low paying career without that many perspective my outlook might differ.

I dont live a place where you pay for your kids being in college so I cant speak for that part.

And, the bigger point is, even if you could afford a house, is that life changing? Would your life style change because you bought a house? Or, would it just basically be the same life style as before except you now own a house?

To me, life changing amount of money means an amount that changes my life style. That could mean, an amount that lets me retire and never work again. Or an amount that lets me quit and start my own company. Or quit and go back to school. Or quit and travel for a few years. Something alone those lines, having my "life change". Buying an apartment but having my life remain the same, same job, same hours, same activities, is not "life changing" to me.

I fully admit a $240k bonus ($140k after taxes) it could be life changing for others. If I'd been 19yrs old when my living expenses were $20k year, then $140k in the bank would have let me go ~7yrs without a job. Unfortunately my 19yr old self would have probably blown 30% on a car, 20% on travel or other things, 10-20% on random equipment like a new gaming rig or cameras and lens and then in a few months I'd be back where I was. And, even if I did manage to not blow it and do the 7 years, what else could I have done. Could I started a company and hired people? How many could I afford to hire and for how long? Would it be enough to not just lose the money or would have needed more than $140k?

I think you probably know people who've gone though something like this via inheritance. A parent dies, leaves them $200-300k You don't see their life change at all. Of course most people don't inherit that much but enough do that you probably know some of them or your family knows some of them and yet nothing noticable changed in their life.

Still cool that you can get a house so cheap in Sweden.

If you got a $240,000 bonus in the mid-2000s in tech, that very likely means you were living in one of the tech metros (SF, NYC) and you could expect nearly 50% of that to be paid in taxes (CA/Fed, NY/NYC/Fed). So you take home about $120,000.

It's a windfall of money to be sure. But being in an employment situation where even such a bonus is possible likely means you already have significantly higher costs than the average person. Maybe you'll pay down some student loans and bolster your savings. But this is far from being "rich". High-earners also tend to have high costs of living.

of course $140k would be life changing for most people. but OP, and i suspect most of the other commenters, are not in that situation.

It’s a fact that my life didn’t change so it wasn’t a life changing amount of money for me.

Maybe it would be life changing for others. tho at least in sf/nyc/la I suspect it wouldn’t for most people. If I had given it to my sister she’d have used it to pay down her mortgage. her life wouldn’t change. she’d have still had a mortgage and her day to day life wouldn’t have changed at all. My nephew could have used it to pay off his student loans. That would be great but again his daily life wouldn’t have changed

Definitely not going to quit my job.

Definitely not going to go back to school.

Sure, I could spend it on a vacations over the next decade but I could already do that so not life changing.

I like my car already.

Maybe a renovation?

At the end of the day, I'm already doing things I like to do so additional money mostly is just going to be saved which isn't life changing. It's nice but not life _changing_.

It's also an easy language to write a compiler for. At one point I counted over 30 C compilers available for DOS.

You know there’s ongoing and plausible efforts by at least 3 organizations to conquer the Earth, right?

Given this exploit, that would probably lower the payout. There are absolutely tons more sandbox escapes in Chromium engine right now (here's a fun list of previous ones, none of which cost them ad rev[1]), and they're not adversely affecting Google's ad revenue. No company is pulling ads because Chrome has a vuln.

This wouldn't even be the kind of reputational hit that something like SolarWinds was.

[1]: https://github.com/allpaca/chrome-sbx-db

An exploit like this would be abused by somebody who sets up a malicious website to try to take control over somebody's device or otherwise steal secrets from them like keys for cryptocurrencies. These attacks tend to be targeted. Nobody is using an exploit like this to create an ad blocker or even to do ad fraud.

The only risk to revenue here is reputational, and I think that it is likely that the existence of this bug would be less widely known if the bounty program didn't exist and the bug was sold on the black market.

> It's wild how much money big corporations have. ?