A working zero-day exploit for iOS costs between 2 and 5 million US dollars on the gray market in 2026. For Android, the price is 1 to 3 million. Windows kernel exploits are traded for 500,000 to 1.5 million. These figures do not come from rumors but from the publicly available price lists of brokers like Zerodium and Crowdfense.
Why Prices Are Exploding
Prices are rising for three reasons:
- Better defense: Apple, Google, and Microsoft are investing massively in exploit mitigation. Memory safety languages (Rust), hardware features (PAC, MTE on ARM), sandboxing, and lockdown modes make exploits more costly to develop.
- Higher demand: State actors (intelligence agencies, law enforcement, military) are the largest buyers. The market is actively served by at least 40 nations.
- Less supply: Top researchers preferably sell to bug bounty programs (Apple: up to 2M USD, Google: up to 1M USD). The gray market has to bid higher.
The Buyers
The zero-day market has three tiers:
- Legal market: Bug bounty programs from Apple, Google, Microsoft, HackerOne, Bugcrowd. Transparent, legal, but often lower prices.
- Gray market: Brokers like Zerodium, Crowdfense, Operation Zero (Russia). Sell to state customers, often with export restrictions. Legal in many jurisdictions, ethically controversial.
- Black market: Darknet forums, direct sales to cybercriminal groups. Illegal but lucrative.
What This Means for Companies
Zero-days are primarily a state-level problem (espionage, surveillance). But: once an exploit is in circulation, it often shows up in criminal toolkits within months. The cycle is shortening.
Defense against zero-days is not based on patching (the patch does not exist yet) but on:
- Defense in depth: Multiple layers of defense so that a single exploit is not enough.
- Anomaly detection: EDR/XDR that detects unusual behavior even when the exploit is unknown.
- Network monitoring: Unusual data exfiltration, lateral movement, command-and-control communication.
- Minimal attack surface: Disable unneeded services, consistently enforce least privilege.
The zero-day market will not disappear. But defense is getting better. This is an arms race, and currently the defensive side is slowly gaining ground.
Sources: Zerodium Price List, Crowdfense Vulnerability Research Hub, Google Project Zero Annual Review 2025, Citizen Lab Reports.