According to Wikipedia, that's 0.012% of their net income. [0]
While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying.
No. More than 80% of Mozilla Corp's income is a yearly payment from Google. [0]
The payment will stop immediately if Google thinks it's no longer needed, or if federal prosecutors (who have determined this payment is illegal) decide the remedy is to stop the payment. [1]
The CEO's job is simple. Say "I think we should take Google's money again this year", and then pocket several million of it. Ca-ching! What are your plans for post-Google-money? Uh uh... AI? Sell out our users to advertisers? [2] It's not looking good.
The Firefox market share continues to dwindle. The board continues to hob-nob with San Francisco socialites and "activists" and use Mozilla as a piggybank to fund their chums. [edit: removed line about Mitchell Baker as she does seem to have finally left]
> Mitchell Baker did not leave the gravy train by stepping down as CEO, she merely moved to a different seat on the gravy train - chair of the Mozilla Foundation
Mitchell has not been a member of the Mozilla Foundation or Mozilla Corporation boards since February 2025.
That's a bad rubric to judge by, in this case. CEO pay is at a historic high, in fact I'm pretty sure the last time the gap in wage between median workers and CEOs was this high was the roaring 20's, which famously went quite well for the economy.
But Chrome is paying more as a percentage of their browser units' income, no?
Virtually all of Mozilla's income comes from the browser (via the Google search agreement). The vast majority of Google's revenue comes from ad revenue on search, YouTube, and Adsense. Not from Chrome directly. So they had less incentive to reward its security, but did so anyway. And they also do some of the best work in the industry, free, for competitors via Project Zero.
People keep saying that. There are two problems with that, namely ① Google's own ads are easy to block using the new API and ② the new API is effective at blocking various evil attacks. If Google wanted to get rid of ad blockers, I'm sure they could come up with an API that does a better job than that.
Personally I believe that the browser is intended to defend against e.g. Facebook's apps. Google wants to make sure that if you buy a new device and it comes with a Facebook app preinstalled, it also comes with a browser. And that the browser isn't controlled by anyone who'd like to disrupt any of Google's many nice income streams.
To the extent that meth is a viable substitute for cold medicine you'll have those prices correlating.
But more to your point: the bounty is more similar to an auction. Once you sell the bug to the software producer the black market has no more use of it, assuming it gets fixed.
Supply is constrained, so competition is on the demand side.
On the drug example demand is constrained, if you're the only buyer. So competition happens on the supply side.
Sounds fine to me.
[0]: https://en.wikipedia.org/wiki/Mozilla_Corporation
//Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percentage.