Chrome Extensions’ Critical Flaws Let Attackers Easily Compromise Millions of Browsers

Security researchers at Rebora Security disclosed critical vulnerabilities named “Spyder” and “MaXSS” in AI-powered Chrome extensions SiderAI and MaxAI, installed on over 10 million devices. The flaws arise from improper validation of messages between webpages and extension content scripts, enabling malicious sites to execute privileged actions—open hidden tabs, capture screenshots, simulate clicks/keystrokes, and steal sensitive data including emails, authentication tokens, and private AI conversations—without user interaction; vendors did not respond and the issues were publicly disclosed, with users advised to remove the affected extensions immediately.