The only actors who will pay you real money for a serverside RCE bug aren't buying an exploit; they're contracting with you to plan a heist. So the same analysis applies: you yourself could come up with some scheme whereby you yourself use this vulnerability to steal stuff from Google. But that's not what we're talking about when we talk about vulnerability valuations.

There is essentially no market for these kinds of serverside vulnerabilities.

▲

irundebian 6 hours ago | parent [-]

How do you know? You could explain the impact of the vulnerability and let buyers on the black market decide and bid whether they could do something useful with it.

	▲	tptacek 6 hours ago \| parent [-]
		That's not how the "black market" works. There isn't like some bazaar where people describe vulnerabilities and people bid on them. Only a very specific subset of vulnerabilities, those that slot into existing business practices and CNE stacks, have buyers.