Credit: Markus Vervier and Michele Orrù (and of course, Yubico)
Yubico used information provided by Markus Vervier and Michele Orrù to report a security issue in Google Chrome, but did not credit them. They received and accepted a Bug Bounty from Google even though they were not the first to report the bug, as Markus and Michele had already reported the bug to Google through the Chrome Bug Tracker before they did. We actually think Yubico submitted themselves for lamest vendor response just to receive the pwnie.