>Noone is paying $100k in some imaginary black market for web exploits. You're right, it's usually in low-mid $10ks for this sort of thing. >low-grade consume

>Noone is paying $100k in some imaginary black market for web exploits. You're right, it's usually in low-mid $10ks for this sort of thing. >low-grade consumer password manager that no enterprise or governments uses Can't speak to government, but multiple large companies I have worked for have mandated LastPass as the password manager. > But even then your grey market for this is tiny and most likely not going to be some criminal overlord paying out $100k in bitcoin to kids on a darknet forum. In fact that's almost exactly what it is, except you've underestimated the price. A really juicy iOS RCE or Privesc can fetch almost half a million. These transactions aren't usually done on forums, though. Not enough trust. There are middlemen who buy exploits from researchers and sell to the big customers.