All three numbers have an official source, but each drops a condition. Hyper-V's $250K needs a working exploit. Meta's $300K VM escape targets the confidential VM where WhatsApp Private Processing runs AI models; it pays for breaking that infrastructure, not for attacking the model, and is invitation-only. Google's $90K is an RCE on a standard *.google.com service with the top quality multiplier; the most sensitive tier starts at $101,010. A reward table gives a ceiling, not a success rate.
A hypervisor is the software layer between hardware and several operating systems that gives each virtual machine its own isolated execution environment. MSRC's Hyper-V bounty table splits guest escapes into L1 (up to $250,000) and L2 (up to $150,000); the difference is which wall gets crossed.
CVE-2021-28476 is a bug in Hyper-V's virtual network switch driver: a guest VM sends a crafted request, the host code follows an address inside it without checking, and the host crashes. Akamai claims two scenarios, a crash and code execution, but the public PoC only shows the crash; code execution was not publicly demonstrated. CVSS 9.9, patched May 2021. On the bounty table, what was publicly shown maps to the DoS cell (up to $15,000); the L1 guest-escape cell tops out at $250,000 and needs a working RCE exploit, but without an exploit that cell still has $200,000, $100,000 and $50,000 rows.