The US VEP, which is like 10 years old now, is explicit about the fact that zero-day exploits are not fundamentally "NOBUS". That term describes things like Dual EC, or hardware embedded vulnerabilities; things that are actually Hard for an adversary to take advantage of. Chrome chains don't count.