Critical Chrome Extension Vulnerabilities Enable Browser Compromise Attacks

Two critical vulnerabilities in popular AI-powered Chrome extensions (SiderAI and MaxAI) — dubbed “Spyder” and “MaXSS” — allow arbitrary webpages to abuse extension content scripts and background processes to open hidden tabs, capture screenshots, simulate user gestures, dump AI memory, and exfiltrate sensitive data. Proof-of-concept demonstrations show attackers could achieve full account takeover and exfiltrate emails, documents, tokens, and AI conversation links; both extensions remain publicly available and vendors did not respond to responsible disclosure.