An actively exploited remote code execution vulnerability affecting all Chromium versions has sparked debate among security researchers regarding the adequacy of Google's $1,000 bug bounty payout for critical, in-the-wild flaws. Although the vulnerability currently only escapes the JavaScript sandbox and requires chaining with a second flaw for full system compromise, critics argue that major tech companies significantly undervalue ethical disclosures compared to the lucrative exploit grey market.