Why RCE Pays the Most in Google's Reward Table: Command Injection and Unsafe Deserialization
RCE means an outsider can make someone else's machine run code. In Google's table, for a normal *.google.com app, RCE has a $75,000 base reward against $10,000 for XSS. The two beginner paths are user input glued into a shell command and deserializing untrusted data; the fixes are argument lists and JSON.