“The vulnerabilities require no interaction of the victim.”
Two Dutch researchers chained three bugs and took over a machine just by being on the same Zoom call. Windows and Mac clients were both hit. They got $200,000 because a contest put the bug on a stage. The next crew to find one can sell it quietly to someone who pays more and never tells Zoom.