Google multiplies the reward by 0.8, 1 or 1.2 depending on report quality across seven dimensions, and only counts what you provided before triage; later additions usually do not change it. Write to a one-page template (title, summary, preconditions, steps, impact, fix suggestion), then estimate hourly expected value as probability x amount / hours. A bigger ceiling can still lose to a small payout once the odds are low enough. Every probability and hour count in this post is an assumption, not a statistic.
All three numbers have an official source, but each drops a condition. Hyper-V's $250K needs a working exploit. Meta's $300K VM escape targets the confidential VM where WhatsApp Private Processing runs AI models; it pays for breaking that infrastructure, not for attacking the model, and is invitation-only. Google's $90K is an RCE on a standard *.google.com service with the top quality multiplier; the most sensitive tier starts at $101,010. A reward table gives a ceiling, not a success rate.
Ask three things of any program page: is the target on the in-scope list, is my technique excluded (DoS, social engineering), and is the data I touch my own? Safe harbor is the program's promise, not a free pass; Meta's text requires compliance 'in all respects', with a carve-out for clear accidental or good-faith violations, all judged by Meta. Taiwan's Criminal Code arts. 358-360 turn on acting 'without cause'. This is not legal advice.
RCE means an outsider can make someone else's machine run code. In Google's table, for a normal *.google.com app, RCE has a $75,000 base reward against $10,000 for XSS. The two beginner paths are user input glued into a shell command and deserializing untrusted data; the fixes are argument lists and JSON.
CVE-2021-28476 is a bug in Hyper-V's virtual network switch driver: a guest VM sends a crafted request, the host code follows an address inside it without checking, and the host crashes. Akamai claims two scenarios, a crash and code execution, but the public PoC only shows the crash; code execution was not publicly demonstrated. CVSS 9.9, patched May 2021. On the bounty table, what was publicly shown maps to the DoS cell (up to $15,000); the L1 guest-escape cell tops out at $250,000 and needs a working RCE exploit, but without an exploit that cell still has $200,000, $100,000 and $50,000 rows.