Chrome Extension Vulnerabilities: Millions at Risk

Rebora Security Research reports two critical Chrome extension vulnerabilities—MaXSS in MaxAI and Spyder in SiderAI—that allow visiting webpages to send unsanitized messages or synthesize user actions, enabling arbitrary command execution, hidden tab creation, screenshot capture, chat-history theft and data exfiltration; both extensions have broad deployment (millions of installs) and, according to the report, remain unpatched, so users are advised to remove them to prevent account takeover and data leakage.