The new vulnerability, dubbed “Variant 4,” can be exploited through JavaScript in a web browser to steal data.

The legislation would criminalize "unauthorized computer access" and potentially allow companies to conduct offensive hacking operations.

The participant companies' principles include not helping any government mount a cyberattack against "innocent civilians and enterprises."

Inflated bounties might be creating perverse incentives for young cybersecurity researchers and distorting the market for white-hat bug hunters.

"We want our airmen transitioning from running email and boxes to focusing on cyber defense," one official said.

Recorded Future found that cybercriminals exploited PowerPoint the most in 2017 to steal money and information.