6 ms·
If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much
by tptacek 1mo ago
If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched.
Further: a vulnerability is probably not worth that much either, even if it's a hypercapable vulnerability, because the grey market buys full enablement kits, not vulnerability information. People making 6 figures on vulnerabilities are selling fully enabled full chain exploit systems, not just intelligence about a sandbox escape.
- 0xbadcafebee 1mo agoHow much money is lost by consumers/businesses for every hour the vulnerability is exploited in the wild with no patch?
- randyrand 1mo agoThat’s not how things are valued. That’s moreso how the absence of something is valued.
- tantalor 1mo agoThe value of the report is dependent on the scarcity of the knowledge. If anybody can report it, the bid goes down.
- toomuchtodo 1mo agoThere is a theta decay component. The zero day is highly valuable until known; once known, its value rapidly declines to zero.
- onion2k 1mo agoThe value of future reports should also be a component though. By paying a low amount you discourage ethical bug bounty hackers from bothering to look for more exploits. If I think I'm only getting $1000 for a Chrome issue versus $100,000 for an Acme Co issue, I'll be spending my time looking for Acme Co issues. Bug bounties are as much a way of attracting talent to even try to exploit your system as they are about the exploits themselves. If you lowball the bounties the talent goes elsewhere.
- tclancy 1mo agoHow do you figure? The value of the report is, ethics aside, the same as the value of exploiting it. Doesn’t matter if I can conceive of it, it matters if I can exploit it.
- cannonpalms 1mo agoSupply and demand has to be considered. The more parties aware of the vulnerability, the more attractive sellers (reporters) have to make their ask to the buyer (defender).
- brookst 1mo agoNot following that. The report is the upstream resource the exploit needs. The value of iron ore is definitely not the value of the steel made with it. Or maybe I misunderstood your view?
- nixon_why69 1mo agoThat's really informative but maybe a little overly capitalist-brained. We shouldn't look to the black market as cost discovery for these vulnerabilities, most non-criminal researchers are not putting up an ask order and letting the black market compete with Google.
- JoshTriplett 1mo ago> We shouldn't look to the black market as cost discovery for these vulnerabilities We absolutely should. One of the points of bug bounties is to discourage people from selling to the black market.
- nixon_why69 1mo agoThat's one of the points, yes, but the black market doesn't dictate the value of the exploit to Google. A hardline bargaining position with Google would be more like "pay me what I want, or else I'll give it to all takers on the black market for maximum damage". That would be unethical and probably illegal to boot but it's a better definition of value than "1$ greater than max bid".
- xprnio 1mo agoThe value to Google - sure. But the market value of the exploit itself - the black market I think is a factor in that regardless of what Google offers. The value of something is dictated by what _the market_ offers, and just because Google throws a lowball price because _they_ don't value it doesn't necessarily mean that the value of the exploit itself is as low as they dictate. There will always be someone who would screw Google just for the love of the game, and if they got a better price from elsewhere, I don't see why _morality_ would really play that big of a role. It all comes down to incentives, and if Google doesn't incentivize doing the good thing enough, then someone _will_ incentivize them to do the bad thing just a bit more.
- WarmWash 1mo agoYour conflating capitalism with markets. Markets are fundamental things and exist regardless of any kind of moral "should". Otherwise we wouldn't have people buying hard drugs or trafficing women.
- fr2029 1mo ago[flagged]
- itsTyrion 1mo agoBooks I've read would disagree. Are you the emdash police?
- altmanaltman 1mo ago[flagged]
- ukuina 1mo ago> Spacing around an em dash varies. Most newspapers insert a space before and after the dash, and many popular magazines do the same, but most books and journals omit spacing, closing whatever comes before and after the em dash right up next to it.
- blfr 1mo agoAren't we all nowadays.
- fr2029 1mo agocomic books aren't books.
- rileymat2 1mo agoI was under the impression that the three letter agencies and contractors bought vulnerabilities?
- StrauXX 1mo agoSometimes, yes. But usually, as a security researcher, you usually sold to brokers. The brokers made the vulnerability into a reliable exploit. That is whst they then sold to agencies. For a markup of course. The industry was in a tough spot already the past years. Now AI is shaking it up even more.
- monster_truck 1mo agoThey want the good shit, not this bargain bin fuckup
- nullsanity 1mo ago[dead]
- Gabrys1 1mo agoKnowing the vulnerability, creating an exploit might be relatively easy now that we have AI to figure the boring stuff out.
- kllrnohj 1mo agoThis "only" escapes the JavaScript sandbox. You still need to chain it with an escape for the process sandbox. So it's not just the boring stuff of turning a predictable crash into arbitrary execution, but also finding a second RCE vulnerability to chain this with
- fguerraz 1mo agoIf it’s being exploited “in the wild”, it means someone has already found how to chain it, otherwise what would be the point?
- bethekidyouwant 1mo agoRight but this actually hasn’t happened…
- r_lee 1mo ago"Google is aware that an exploit for CVE-2026-85046 exists in the wild."
- kccqzy 1mo agoRight and in recent memory Google actually awarded a renderer sandbox escape with $250k [0]. Now you can see actually how serious this is. [0]: https://news.ycombinator.com/item?id=44861106 https://news.ycombinator.com/item?id=44861106
- anonymars 1mo agoI'm curious now, how is it being actively exploited? Unless there is already some other exploit with which it's currently being chained?
- flatline 1mo agoIsn’t the implication that the vulnerability had already been found and exploited instead of reported to Google, because its value to Google was so low? Whoever found it originally had more incentive to sell it on the grey/black market. Or is the incentive structure truly different for vulnerabilities discovered to be already in the wild?
- infinite_spin 1mo agoSome exploit hunters sell strictly to the grey/black market to avoid opsec issues. If you're selling on both, you're more likely to be identified by both.
- toast0 1mo agoSurely google has telemetry when their sandbox is escaped? (Only mostly /s)