Google Paid $13,337 for a Bug Found in Chrome's Network Tab

Google's Vulnerability Reward Program paid $13,337.00 for a search exploit that Mark Williams-Cook found not through crawling or leaks, but by deleting one parameter in a network request visible in Chrome DevTools. The panel noted that "exploitation likelihood is high" and that the issue "qualified as an abuse-related methodology with high impact." Williams-Cook, who runs AlsoAsked, has chosen to take that as a compliment.

The story is the centerpiece of a detailed account he has published on how reverse engineering browser network data has become one of the last cheap sources of competitive intelligence in SEO. The exploit itself came from a callback URL with a large parameter string spotted while digging through request headers. After replaying the request with curl, his team noticed a parameter called _fmt set to prog. They deleted it. Google responded with structured data: site quality scores, inverse document frequency scores, last-significant-update timestamps in epoch time, and the server IP. He reported the vulnerability roughly a year after finding it.

What does the network data change for practitioners?

The clearest example is query classification. Google assigns nearly every query to one of eight "refined query" semantic classes. Across a sample of 4.8 million English queries, Williams-Cook captured the distribution of those labels, trained DistilBERT — 40% smaller and 60% faster than BERT at inference, retaining about 96% of its performance — and finished the fine-tuning in roughly 50 hours on a gaming laptop. The result, QueryClassifier, is free online. It predicts how Google will classify any query, which in turn indicates the content type and SERP features Google expects. At 99.9% confidence, "what happens if john mueller eats cheese" is a CONSEQUENCE query.

The ChatGPT findings carry more weight for AI visibility work. Using Perplexity Computer, an agent orchestration system that ran real Chrome instances via Playwright, Williams-Cook was among the first to identify that ChatGPT pulls results from distinct source sets labeled in a result_source field: serp, labrador and bright. He published the finding under time pressure after Metehan Yesilyurt teased a related reveal on LinkedIn. Later work went further: Tomek Rudzki's research for Peec AI found result_source carries four values — Labrador, Bright, Oxylabs and SERP — and that Labrador is a family of vertical indexes covering the general web, PDFs, YouTube, news, arXiv, Wikipedia, local, finance, legal, medical, shopping and images.

Is Reddit still worth the effort?

Citation charts say no. Petra Labs' analysis of 113,500 ChatGPT runs showed Reddit's share of final citations fell roughly 80% in a single day in mid-August 2026, shortly after GPT-5.6 became the default model. The network data disagrees with the surface conclusion. Research by Suganthan Mohanadasan, whose free Chrome extension FanoutFox reads a user's own ChatGPT session, shows Reddit is still read as much as ever in fan-out searches, which now lean heavily on site: queries. ChatGPT uses Reddit threads to decide whether to recommend a brand, then cites the vendor's own page instead. Williams-Cook's framing is direct: counting links in an answer tells you what the model chose to show, not what it chose to read.

FanoutFox surfaced two further findings. First, freshness windows: ChatGPT attaches a time window in days to its searches. Stock price queries carry a two-day window, Premier League results seven, "best AI live chat software" 30, Nvidia earnings guidance 90, and Reddit-focused live chat research 365. Second, whether retrieval happens at all. A self-help book recommendation came entirely from the model's parametric memory, with no web search run — meaning short-term influence on that answer is close to impossible.

What comes next

None of this requires a development team. Perplexity Computer can run the browsers, capture traffic and build a custom Chrome extension loadable in two clicks via chrome://extensions. Williams-Cook cautions that these formats shift quickly: the search_queries field he and Mohanadasan relied on has vanished entirely. The practical takeaway for content teams is to stop guessing freshness requirements and citation strategy, and start reading the traffic that already sits one F12 away.