NewsPublished 19 Sep 2026

BragJack · $20K in bounty rewards from Anthropic, Perplexity, Google, Microsoft and Opera Using 1 Extension

Source Reddit NetSec

Discussion

A security researcher named Gal Weizman disclosed a browser security research achievement involving a single browser extension that successfully exploited vulnerabilities in Chrome, Comet, Edge, Opera, and Claude in Chrome. This research led to the discovery of two CVEs and earned $20,000 in bounty rewards from multiple major vendors including Anthropic, Perplexity, Google, Microsoft, and Opera. No detailed technical information or affected versions are provided.

r/netsec (opens in a new tab)u/Content-Winter53280 points0 comments

Hi folks, my name is Gal Weizman, I do browser security research.

Excited to finally share my recent work, where I managed to hack Chrome, Comet, Edge, Opera and Claude in Chrome using one single browser extension

2 CVEs & $20,000 in bounties 🙂

Hope you like it!

Impact

The impact involves multiple browsers and platforms being vulnerable to the same extension-based exploit vector, as demonstrated by the researcher. The vulnerabilities were significant enough to warrant CVE assignments and bounty rewards from major vendors, indicating a meaningful security risk. However, no information about active exploitation or specific consequences is provided.

Defensive guidance

Since the vulnerabilities have been assigned CVEs and bounty rewards issued, it is likely that vendors have addressed or are addressing the issues. Users and administrators should monitor official vendor advisories for patches or updates related to these CVEs. No direct mitigation steps can be recommended without further technical details.

Summary

The researcher developed a single browser extension that was able to exploit security vulnerabilities across multiple browsers and platforms (Chrome, Comet, Edge, Opera, and Claude in Chrome). This work resulted in two CVE assignments and bounty payments from several prominent organizations. Specific technical details, exploitation methods, or vulnerability descriptions are not included in the provided information.

References

reddit.com/r/netsec/comments/1wkrcgz/bragjack_20k_in_bounty_rewards_from_anthropic/ (opens in a new tab)

Community reviews

Loading reviews…

Discussion

AI analysisMachine-generated, updated 19 Sep 2026, 17:01 UTC

Technical details

References

Community reviews

Related threats