Zero-Day Market
Acquisition prices from exploit brokers — verified snapshots.
Mobile — Full Chains
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
Android Zero Click Full Chain
|
Full Chain
|
$5,000,000
|
$5,000,000
|
$5,000,000
|
–
|
|
SMS/MMS Full Chain Zero Click
|
Full Chain
|
$7,000,000 – $9,000,000
|
—
|
—
|
removed
|
|
WhatsApp (RCE+LPE)
|
RCE+LPE
|
$1,500,000
|
—
|
—
|
removed
|
|
WhatsApp Zero Click (RCE+LPE)
|
Full Chain
|
$3,000,000 – $5,000,000
|
—
|
—
|
removed
|
|
iMessage (RCE+LPE)
|
RCE+LPE
|
$1,500,000
|
—
|
—
|
removed
|
|
iMessage Zero Click (RCE+LPE)
|
Full Chain
|
$3,000,000 – $5,000,000
|
—
|
—
|
removed
|
|
iOS (RCE+SBX)
|
Partial
|
$3,500,000
|
—
|
—
|
removed
|
|
iOS Zero Click Full Chain
|
Full Chain
|
$5,000,000 – $7,000,000
|
$5,000,000 – $7,000,000
|
$5,000,000 – $7,000,000
|
–
|
Mobile — Browsers
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
Chrome mobile (RCE w/o SBX)
|
RCE
|
$500,000
|
$500,000
|
$500,000
|
–
|
|
Chrome mobile (RCE+LPE)
|
RCE+LPE
|
$2,000,000 – $3,000,000
|
$2,000,000 – $3,000,000
|
—
|
removed
|
|
Chrome mobile (SBX)
|
SBX
|
$500,000
|
$500,000
|
$500,000
|
–
|
|
Safari mobile (RCE w/o SBX)
|
RCE
|
$200,000
|
$200,000
|
$500,000
|
↑
|
|
Safari mobile (RCE+LPE)
|
RCE+LPE
|
$2,500,000 – $3,500,000
|
$2,500,000 – $3,500,000
|
—
|
removed
|
|
Safari mobile (SBX)
|
SBX
|
$300,000 – $400,000
|
$300,000 – $400,000
|
$500,000
|
↑
|
|
Chrome One Click Full Chain (RCE+v8 SBX+SBX+LPE)
|
Full Chain
|
—
|
—
|
$2,000,000 – $3,000,000
|
new
|
|
Safari One Click Full Chain (RCE+SBX+LPE)
|
Full Chain
|
—
|
—
|
$2,500,000 – $3,500,000
|
new
|
Mobile — Other
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
Baseband (Qualcomm/MediaTek/Samsung/Intel/Unisoc) RCE
|
RCE
|
$500,000
|
—
|
—
|
removed
|
|
Documents (RCE+LPE)
|
RCE+LPE
|
$200,000
|
—
|
—
|
removed
|
|
LPE to Kernel/Root
|
LPE
|
$800,000
|
—
|
—
|
removed
|
|
Media File (RCE+LPE)
|
RCE+LPE
|
$200,000
|
—
|
—
|
removed
|
|
Persistence
|
Persistence
|
$500,000
|
—
|
—
|
removed
|
Mobile — Apps
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
Other apps (iCloud/Signal/FaceTime/Telegram/etc.)
|
Individual
|
On request
|
—
|
—
|
–
|
|
Other apps (iCloud/Calendar/Email/Signal/FaceTime/etc.)
|
Individual
|
—
|
On request
|
On request
|
–
|
Desktop — OS
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
Linux (LPE)
|
LPE
|
$100,000
|
$100,000
|
$100,000
|
–
|
|
Windows (LPE/SBX)
|
LPE/SBX
|
$150,000
|
—
|
—
|
removed
|
|
Windows Zero Click Full Chain
|
Full Chain
|
$2,000,000
|
$2,000,000
|
$1,000,000
|
↓
|
|
macOS (LPE)
|
LPE
|
$150,000
|
$100,000
|
$100,000
|
–
|
|
Windows (LPE)
|
LPE
|
—
|
$100,000
|
$100,000
|
–
|
|
Windows (SBX)
|
SBX
|
—
|
$150,000
|
$150,000
|
–
|
Desktop — Browsers
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
Chrome Full Chain (RCE+SBX+LPE)
|
Full Chain
|
$1,500,000
|
$1,500,000
|
—
|
removed
|
|
Edge Full Chain (RCE+SBX+LPE)
|
Full Chain
|
$400,000
|
—
|
—
|
removed
|
|
Firefox Full Chain (RCE+SBX+LPE)
|
Full Chain
|
$350,000
|
$300,000
|
$300,000
|
–
|
|
Safari Full Chain (RCE+SBX+LPE)
|
Full Chain
|
$500,000
|
—
|
—
|
removed
|
|
Tor
|
Full Chain
|
$500,000
|
$500,000
|
$500,000
|
–
|
|
Chrome Full Chain (RCE+v8 SBX+SBX+LPE)
|
Full Chain
|
—
|
—
|
$1,500,000
|
new
|
Desktop — Applications
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
7-zip (RCE)
|
RCE
|
$80,000
|
$80,000
|
$80,000
|
–
|
|
Adobe Acrobat Reader (RCE+SBX)
|
RCE+SBX
|
$200,000
|
$200,000
|
$200,000
|
–
|
|
Antivirus (LPE)
|
LPE
|
$10,000
|
$10,000
|
$10,000
|
–
|
|
Antivirus (RCE)
|
RCE
|
$50,000
|
$50,000
|
$50,000
|
–
|
|
Microsoft Outlook (RCE)
|
RCE
|
$250,000
|
$250,000
|
$300,000
|
↑
|
|
Microsoft Word/Excel (RCE)
|
RCE
|
$400,000
|
$500,000
|
$500,000
|
–
|
|
Mozilla Thunderbird (RCE)
|
RCE
|
$200,000
|
$200,000
|
$200,000
|
–
|
|
WinRAR (RCE)
|
RCE
|
$100,000
|
$100,000
|
$100,000
|
–
|
|
WinZip (RCE)
|
RCE
|
$50,000
|
$50,000
|
$50,000
|
–
|
|
tar (RCE)
|
RCE
|
$50,000
|
—
|
—
|
removed
|
Virtualisation
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
Microsoft Hyper-V (VME)
|
VME
|
$1,000,000
|
—
|
—
|
removed
|
|
Parallels Desktop (VME)
|
VME
|
$300,000
|
$300,000
|
$300,000
|
–
|
|
VMware ESXi (RCE)
|
RCE
|
$1,000,000
|
—
|
—
|
removed
|
|
VMware Workstation (VME)
|
VME
|
$300,000
|
$300,000
|
$300,000
|
–
|
|
Microsoft Hyper-V
|
VME
|
—
|
$500,000
|
$500,000
|
–
|
|
VMware ESXi
|
RCE
|
—
|
$500,000
|
$500,000
|
–
|
Enterprise — Web & Mail
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
Apache HTTP Server (RCE)
|
RCE
|
$500,000
|
$500,000
|
$500,000
|
–
|
|
MS SQL Server / Oracle Database (RCE)
|
RCE
|
$150,000
|
$150,000
|
$150,000
|
–
|
|
Microsoft Exchange (RCE)
|
RCE
|
$250,000
|
$250,000
|
$250,000
|
–
|
|
Microsoft IIS (RCE)
|
RCE
|
$500,000
|
$500,000
|
$500,000
|
–
|
|
Nginx (RCE)
|
RCE
|
$300,000
|
$300,000
|
$350,000
|
↑
|
|
OpenSSL (RCE)
|
RCE
|
$250,000
|
$250,000
|
$250,000
|
–
|
|
PHP (RCE)
|
RCE
|
$250,000
|
$250,000
|
$250,000
|
–
|
|
Red Hat JBoss / Apache Tomcat (RCE)
|
RCE
|
$50,000
|
$50,000
|
$50,000
|
–
|
|
Sendmail / Postfix / Exim / Dovecot (RCE)
|
RCE
|
$200,000
|
$200,000
|
$200,000
|
–
|
|
WordPress (RCE)
|
RCE
|
$500,000
|
$500,000
|
$500,000
|
–
|
Enterprise — EMS/PLM/ERP
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
IPMI (Sun/Dell/HP/Supermicro/Cisco) (RCE)
|
RCE
|
$100,000
|
$100,000
|
$100,000
|
–
|
|
Microsoft SharePoint (RCE)
|
RCE
|
$250,000
|
$250,000
|
$250,000
|
–
|
|
Oracle ERP / Agile PLM (RCE)
|
RCE
|
$200,000
|
$200,000
|
$200,000
|
–
|
|
SAP (RCE)
|
RCE
|
$250,000
|
$250,000
|
$250,000
|
–
|
|
Siemens Teamcenter (RCE)
|
RCE
|
$250,000
|
$250,000
|
$250,000
|
–
|
|
VNC / TeamViewer / Radmin (RCE)
|
RCE
|
$100,000
|
$100,000
|
$100,000
|
–
|
|
IBM FileNet / Oracle WebCenter (RCE)
|
RCE
|
—
|
—
|
$100,000
|
new
|
|
MongoDB / MySQL (RCE)
|
RCE
|
—
|
—
|
$30,000
|
new
|
Web Apps & CMS
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
Confluence (RCE)
|
RCE
|
$50,000
|
$50,000
|
$50,000
|
–
|
|
Drupal (RCE)
|
RCE
|
$25,000
|
$25,000
|
$25,000
|
–
|
|
Joomla (RCE)
|
RCE
|
$40,000
|
$40,000
|
$40,000
|
–
|
|
Plesk / Webmin (RCE)
|
RCE
|
$100,000
|
$100,000
|
$100,000
|
–
|
|
cPanel / WHM (RCE)
|
RCE
|
$100,000
|
$100,000
|
$100,000
|
–
|
|
phpBB / MyBB (RCE)
|
RCE
|
$50,000
|
$50,000
|
$50,000
|
–
|
|
vBulletin / Invision Power Board (RCE)
|
RCE
|
$75,000
|
$75,000
|
$75,000
|
–
|
|
CentOS Web Panel (RCE)
|
RCE
|
—
|
—
|
$100,000
|
new
|
Appliances & Devices
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
CCTV (RCE)
|
RCE
|
$30,000
|
$30,000
|
$30,000
|
–
|
|
Cisco / FortiNet / Mikrotik (RCE)
|
RCE
|
$100,000
|
$100,000
|
$100,000
|
–
|
|
Citrix / Sonicwall / Huawei / Sophos (RCE)
|
RCE
|
$100,000
|
$100,000
|
$100,000
|
–
|
|
D-Link / TP-Link / Netgear / Ubiquiti (RCE)
|
RCE
|
$50,000
|
$50,000
|
$50,000
|
–
|
|
Hikvision DVR (RCE)
|
RCE
|
$50,000
|
$50,000
|
—
|
removed
|
|
Juniper (RCE)
|
RCE
|
$75,000
|
$75,000
|
$75,000
|
–
|
|
NAS (Synology/QNAP) (RCE)
|
RCE
|
$60,000
|
$60,000
|
$60,000
|
–
|
|
Printers (RCE)
|
RCE
|
$25,000
|
$25,000
|
—
|
removed
|
|
Hikvision (RCE)
|
RCE
|
—
|
—
|
$50,000
|
new
|
Research & Techniques
| Target |
Type |
May 8, 2024 |
April 26, 2025 |
March 24, 2026 |
Δ |
|
(k)ASLR Bypass
|
Bypass
|
$100,000
|
—
|
—
|
removed
|
|
Code Signing Bypass
|
Bypass
|
$100,000
|
—
|
—
|
removed
|
|
Information Disclosure/Leak
|
InfoDisc
|
$100,000
|
—
|
—
|
removed
|
|
PIN/Passcode/Touch ID Bypass
|
Bypass
|
$100,000
|
—
|
—
|
removed
|
|
RCE via MitM
|
RCE
|
$100,000
|
—
|
—
|
removed
|
|
USB (LPE)
|
LPE
|
$50,000
|
—
|
—
|
removed
|
|
WiFi (RCE)
|
RCE
|
$500,000
|
—
|
—
|
removed
|
Source: https://www.crowdfense.com/exploit-acquisition-program/
— data verified via Wayback Machine snapshots.