Critical Chrome Extension Vulnerabilities Let Attackers Easily Compromise Browsers

Critical vulnerabilities named “MaXSS” and “Spyder” in AI-powered Chrome extensions SiderAI and MaxAI (over ~10 million installs) allow malicious webpages to abuse insecure content-script/background communication to perform privileged actions—opening hidden tabs, capturing screenshots, simulating interactions, accessing AI accounts, and exfiltrating sensitive data—requiring only that a user visit a crafted page; vendors were unresponsive and Google was notified.