Chrome Extensions\u2019 Critical Flaws Let Attackers Easily Compromise Millions of Browsers
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Critical security flaws discovered in widely used Chrome extensions<\/a> SiderAI and MaxAI are putting millions of users at risk, enabling attackers to fully compromise browser sessions and potentially access sensitive data across websites and local systems.<\/p>\n Security researchers at Rebora Security uncovered vulnerabilities dubbed \u201cSpyder\u201d and \u201cMaXSS\u201d affecting AI-powered \u201cagentic side panel\u201d extensions.<\/p>\n These tools, designed to enhance browsing through AI-driven summaries and automation, are installed on more than 10 million devices across Chrome-compatible browsers.<\/p>\n Notably, SiderAI ranks among the top 25 extensions on the Chrome Web Store, highlighting the scale of exposure.<\/p>\n The vulnerabilities stem from insecure handling of communication between web pages and the extension\u2019s internal components, particularly content scripts.<\/p>\n In Chrome extensions, content scripts act as intermediaries between websites and the extension\u2019s background processes.<\/p>\n While they are supposed to enforce strict isolation, both SiderAI and MaxAI failed to validate inputs received from web pages properly.<\/p>\n In the case of MaxAI, researchers found that malicious websites<\/a> could send crafted messages to the extension\u2019s content script, which would then forward them to the background process without proper verification.<\/p>\nVulnerabilities in Chrome extensions<\/strong><\/h2>\n