5 ms·
How much does a Firefox 0-day cost these days on the grey market compared to a Chrome 0-day with sandbox escape?
by tillulen 2y ago
How much does a Firefox 0-day cost these days on the grey market compared to a Chrome 0-day with sandbox escape?
- tptacek 2y agoDrastically less.
- mr_mitm 2y agoNot sure how reliable this information is [1], but apparently, 200k vs 500k. Another [2] organization states 350k vs 1.5M (including LPE). [1] https://opzero.ru/en/prices/ https://opzero.ru/en/prices/ [2] https://www.crowdfense.com/exploit-acquisition-program/ https://www.crowdfense.com/exploit-acquisition-program/
- Arech 2y agoDisproportionally more if you divide it on the user base to get the cost of targeting 1 user when you want them all (and most of evildoers want that exactly).
- tptacek 2y agoNo, that's not at all how the market for high-end zero-day vulnerabilities work. It's interesting to see people just make random stuff up from first principles. Actual market participants have talked through this stuff; you can just find out empirically.