4 ms·
Here is some more data regarding Chrome vs Safari, from https://www.zerodium.com/program.html https://www.zerodium.com/program.html These are prices for 0-day
by metroholografix 8y ago
Here is some more data regarding Chrome vs Safari, from https://www.zerodium.com/program.html https://www.zerodium.com/program.html
These are prices for 0-day exploits.
For desktops :
$250,000 - Chrome RCE + SBX (Windows) including a sandbox escape
$80,000 - Safari + SBX including a sandbox escape (it is on the graphical table below the changelog)
$100,000 - Chrome RCE without a sandbox escape
$50,000 - Edge, Safari, Firefox RCE without a sandbox escape
To me, these prices clearly indicate that Safari is a lot easier to exploit than Chrome. They also indicate that the Chrome sandbox is a lot harder to bypass (look at the relative price differences).
For mobile the payouts are similar which indicates that Apple has paid more attention to IOS security-wise. That is also the consensus amongst most security experts I know.
- saagarjha 8y agoMy guess is that the payout is partially a function of popularity, which is why the Windows exploits have higher bounties.
- creddit 8y agoExactly. His argument would make sense if there were ONLY supply side differences but there are clearly HUGE demand side differences with Chrome making up a large majority of internet traffic.