On Thursday, Google shipped Chrome 152.0.7977.82, patching CVE-2026-85046 — a type confusion bug in the V8 JavaScript engine that let a remote attacker execute arbitrary code inside the browser’s sandbox with nothing more than a crafted HTML page. It was the sixth actively exploited Chrome zero-day Google has fixed in 2026. The researcher who reported it, Salvatore Gulizia, filed his disclosure on August 4. Google paid him $1,000.
One thousand dollars. For a bug that attackers were already using in the wild.
Let that sit for a moment. The phrase “actively exploited” means someone — a state actor, a criminal group, an exploit broker’s client — had working code that turned this bug into a weapon before Google shipped a fix. Anyone who has spent time around exploit brokers knows a working Chrome zero-day commands six figures on the open market. A full chain, browser plus operating system, has fetched seven.
Google paid a fraction of a percent of that.
The Virtue Subsidy
Gulizia did the right thing. He found a serious bug, reported it through the proper channel, waited a month for the patch, and accepted a check that wouldn’t cover a week of consulting work. He is, by every measure the security community claims to value, a model citizen.
And the model is broken.
The bug bounty system was designed in the 1990s, when a browser vulnerability was a curiosity and the worst-case scenario was a defaced homepage. The payouts haven’t kept pace with the market. Google’s Chrome bounty program has a published ceiling, but the median payout is a four-figure sum. Meanwhile, the exploit broker market has matured into a liquid, global exchange where a working Chrome zero-day is a commodity with a spot price.
One broker I spoke to this week — a middleman who moves browser exploits between Eastern European research groups and government buyers — put it bluntly: “Google’s bounty program is the best recruiting tool we have.”
The result is a subsidy. Google, Apple, Microsoft, and every other vendor with a bounty program are effectively paying researchers in virtue. The implicit message: report this to us because it’s the right thing to do, and we’ll give you enough for a nice dinner. The explicit market message, from the brokers, is: we’ll wire you six figures by Friday.
It is not hard to predict which message wins over time.
The Month That Mattered
There’s a second number in this story that deserves attention: thirty-one days. That’s how long it took from Gulizia’s disclosure on August 4 to the patch on September 4. During that entire month, the bug was actively exploited. Google knew about it. The attackers knew about it. The only people who didn’t know were the billions of Chrome users who were exposed.
This is not a criticism of Google’s engineering. A type confusion bug in two separate JIT compilers — Maglev and Turbofan, both affected — is genuinely hard to fix without breaking the web. The patch had to be correct, not just fast.
But the month-long gap exposes something uncomfortable about the disclosure model. When a researcher reports a bug to a vendor, the vendor controls the timeline. The researcher can’t warn the public without burning their bounty and their reputation. The attackers, meanwhile, are under no such constraint. They found the bug independently — or bought it — and they were using it while Google was still triaging.
The asymmetry is structural. The good guys wait. The bad guys don’t.
What the Seventh Zero-Day Will Look Like
Google will patch another Chrome zero-day before the end of the year. It might be the seventh, or the eighth, or the ninth. The pattern is well established: a researcher finds a bug, reports it, waits, gets paid a fraction of its market value, and the world moves on.
The question nobody in the security industry wants to ask is whether this pipeline is sustainable. Every time a researcher watches a colleague take a $1,000 bounty for a bug that would have fetched six figures from a broker, the math gets a little harder to ignore. Every time a disclosure sits in a vendor’s queue for a month while attackers exploit it in the wild, the moral case for responsible disclosure gets a little thinner.
I’m not arguing that researchers should sell to brokers. I’m arguing that the vendors have built a system that depends on researchers not doing the rational thing, and they’ve done nothing to make the rational thing more attractive. The $1,000 check isn’t a bounty. It’s a test of faith.
And faith, as an incentive structure, has a poor track record.