BragJack - $20K in bounty rewards from Anthropic, Perplexity, Google, Microsoft and Opera Using 1 Extension
A security researcher named Gal Weizman disclosed a browser security research achievement involving a single browser extension that successfully exploited vulnerabilities in Chrome, Comet, Edge, Opera, and Claude in Chrome. This research led to the discovery of two CVEs and earned $20,000 in bounty rewards from multiple major vendors including Anthropic, Perplexity, Google, Microsoft, and Opera. No detailed technical information or affected versions are provided.
AI Analysis
Technical Summary
The researcher developed a single browser extension that was able to exploit security vulnerabilities across multiple browsers and platforms (Chrome, Comet, Edge, Opera, and Claude in Chrome). This work resulted in two CVE assignments and bounty payments from several prominent organizations. Specific technical details, exploitation methods, or vulnerability descriptions are not included in the provided information.
Potential Impact
The impact involves multiple browsers and platforms being vulnerable to the same extension-based exploit vector, as demonstrated by the researcher. The vulnerabilities were significant enough to warrant CVE assignments and bounty rewards from major vendors, indicating a meaningful security risk. However, no information about active exploitation or specific consequences is provided.
Mitigation Recommendations
No patch or remediation details are provided in the input data. Since the vulnerabilities have been assigned CVEs and bounty rewards issued, it is likely that vendors have addressed or are addressing the issues. Users and administrators should monitor official vendor advisories for patches or updates related to these CVEs. No direct mitigation steps can be recommended without further technical details.
BragJack - $20K in bounty rewards from Anthropic, Perplexity, Google, Microsoft and Opera Using 1 Extension
Description
A security researcher named Gal Weizman disclosed a browser security research achievement involving a single browser extension that successfully exploited vulnerabilities in Chrome, Comet, Edge, Opera, and Claude in Chrome. This research led to the discovery of two CVEs and earned $20,000 in bounty rewards from multiple major vendors including Anthropic, Perplexity, Google, Microsoft, and Opera. No detailed technical information or affected versions are provided.
Reddit Discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The researcher developed a single browser extension that was able to exploit security vulnerabilities across multiple browsers and platforms (Chrome, Comet, Edge, Opera, and Claude in Chrome). This work resulted in two CVE assignments and bounty payments from several prominent organizations. Specific technical details, exploitation methods, or vulnerability descriptions are not included in the provided information.
Potential Impact
The impact involves multiple browsers and platforms being vulnerable to the same extension-based exploit vector, as demonstrated by the researcher. The vulnerabilities were significant enough to warrant CVE assignments and bounty rewards from major vendors, indicating a meaningful security risk. However, no information about active exploitation or specific consequences is provided.
Defensive Guidance
No patch or remediation details are provided in the input data. Since the vulnerabilities have been assigned CVEs and bounty rewards issued, it is likely that vendors have addressed or are addressing the issues. Users and administrators should monitor official vendor advisories for patches or updates related to these CVEs. No direct mitigation steps can be recommended without further technical details.
Technical Details
- Source Type
- Subreddit
- netsec
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Newsworthiness Assessment
- {"score":27,"reasons":["external_link","established_author","very_recent"],"isNewsworthy":true}
- Has External Source
- false
- Trusted Domain
- false
Threat ID: 6aaebfe955bf5e2cf5c527b5
Added to database: 09/19/2026, 17:01:29 UTC
Last enriched: 09/19/2026, 17:01:33 UTC
Last updated: 09/20/2026, 05:31:23 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.