[clay_to_n]

Vupen launched Zerodium fairly recently, which is a bug bounty program to do exactly this. Though I think they sell to other government agencies besides just the U.S.

Largest exploit type goes for up to $1.5MM: https://zerodium.com/program.html

[switz]

Found a bug -- they override the browser's scrollbar.

[ColanR]

wow. I'm surprised that I didn't hear about this before.