It’s great to be getting back into bug bounty hunting! One of the recent security vulnerability in Google Chrome, now tracked as CVE-2026-113215, which was fixed and rewarded through Google’s Vulnerability Rewards Program. Over the years, I’ve found security vulnerabilities in Firefox, Chrome and Brave. Some of my previous findings include: - CVE-2017-7843: Tracking users across Firefox private browsing sessions through IndexedDB. - CVE-2018-12400: Private browsing information leaking through cached favicons in Firefox for Android. - CVE-2019-17004: Cross-site scripting vulnerability affecting Firefox iOS and Brave iOS. - CVE-2020-12414: Private browsing data persisting in IndexedDB on Firefox iOS. Finding security vulnerabilities is a lot about understanding how systems work. You spend time reading code, learning the architecture, understanding assumptions, finding missing pieces, fuzzing, experimenting, and following unexpected behaviour. Often, the hardest part isn’t writing an exploit. It’s knowing where to look and asking the right questions. This is where AI is becoming incredibly useful. I’ve been experimenting with open-weight models and building security agents that can help explore large codebases, investigate hypotheses, generate test cases, reproduce issues, and reason about potential fixes. The latest Chrome vulnerability wasn’t discovered entirely using AI. But working on it reinforced how much these tools can accelerate the research process. What previously took hours of reading code and tracing behaviour can sometimes be explored much faster. That means more hypotheses to test, more experiments to run, and more time to focus on the interesting problems. And the opportunity goes beyond finding vulnerabilities. AI can also help developers understand root causes, evaluate fixes, and build regression tests so the same issues don’t return. Human curiosity, intuition and judgment still matter enormously. AI gives us a new set of tools to apply them at a much greater scale. It’s been a great experience getting back into security research while building agents with open-weight models. I’m excited to see how far we can push this. #SecurityResearch #BugBounty #OpenWeightModels #AISecurity