The publicly available exploit prices put a browser zero day at $200k-$500k. That's the same cost as firing a few Javalin missiles. OS RCE runs into $1-$2 million. Much less than a cheap Russian tank. [1]
The cost of internally developed exploits is probably much lower. They aren't one shot assets either, they can be used until someone plugs the hole.
There are private companies selling devices to law enforcement that can extract information from locked phones [2]. Availability of that sort of access to anyone's phone by local law enforcement is absurdly cheap.
The cost of internally developed exploits is probably much lower. They aren't one shot assets either, they can be used until someone plugs the hole.
There are private companies selling devices to law enforcement that can extract information from locked phones [2]. Availability of that sort of access to anyone's phone by local law enforcement is absurdly cheap.
[1]: https://opzero.ru/en/prices/
[2]: https://arstechnica.com/gadgets/2025/10/leaker-reveals-which...