Critical Flaws in Chrome Extensions Expose Millions to Browser Compromise
Article Content
- •Critical vulnerabilities in SiderAI and MaxAI extensions affect over 10 million users.
- •Attackers can fully compromise browser sessions using the 'Spyder' and 'MaXSS' exploits.
- •Users of Chrome and Chromium-based browsers are urged to take immediate action.
Security researchers at Rebora Security have identified critical vulnerabilities in popular Chrome extensions SiderAI and MaxAI, affecting millions of users. The vulnerabilities, named 'Spyder' and 'MaXSS', allow attackers to fully compromise browser sessions, potentially accessing sensitive data. These extensions, which have over 10 million installations, are designed to assist users with AI-powered features. The flaws pose a significant risk as they transform these tools into vectors for malicious exploitation. Users of Chrome and other Chromium-based browsers are particularly at risk. Immediate action is recommended to mitigate potential threats. The vulnerabilities have been disclosed as part of ongoing security research efforts.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Continue Reading
Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access… 
GitLab Issues Emergency Patch for Critical RCE Vulnerability GitLab has released emergency patches for a critical remote code execution vulnerability, CVE-2026-97229, affecting its Community and Enterprise Editions. This flaw, stemming from an integer overflow in the CI/CD regular expression compiler, allows unauthenticated attackers to execute arbitrary code via specially…