Critical SiderAI and MaxAI Flaws Put Millions of Chrome Users at Risk

Security researchers have disclosed two severe vulnerabilities in the SiderAI and MaxAI Chrome extensions that could let a malicious website compromise a user’s browser session. The flaws, named Spyder and MaXSS by Rebora Security, affect AI side panel extensions used across Chromium-based browsers.

The main risk is simple: if a user has one of the affected extensions installed, visiting a malicious website could allow attackers to abuse the extension’s privileges. Depending on the extension and attack path, researchers said attackers could access browser sessions, interact with logged-in websites, capture screenshots, or perform actions as the victim.

Rebora said the two extensions are installed across more than 10 million devices. SiderAI accounts for most of that exposure, while MaxAI has more than 1 million users, according to the researchers’ store-based estimates.

How the Chrome extension flaws work

The vulnerabilities center on how the extensions handled communication between webpages, extension content scripts, and privileged extension components. Google’s documentation explains that content scripts can read and change pages visited by the browser, then pass information to the parent extension.

That design can be safe when developers validate messages and restrict access. In these cases, Rebora found that the extensions trusted messages or events from webpages too broadly, allowing ordinary sites to reach powerful extension behavior.

Chrome extensions use internal communication channels to connect content scripts, extension pages, and background service workers. Google’s message passing documentation describes how these components exchange data, which makes proper message validation critical.

Finding	Affected extension	Main issue	Reported impact
MaXSS	MaxAI	Unsafe communication between webpages and extension components	Potential universal XSS, screenshots, hidden tab activity, and access to sensitive browser data
Spyder	SiderAI	Unsafe handling of embedded webpages and artificial gestures	Hidden interaction with logged-in websites, data leakage, and actions performed as the user

MaxAI flaw could expose tabs, screenshots, and logged-in sessions

The MaxAI vulnerability, described in Rebora’s MaXSS technical report, allowed arbitrary websites to invoke privileged extension functions. Researchers said the flaw could let attackers query open tabs, open hidden windows, capture visible tabs, and use extension-level permissions against other websites.

In practical terms, a malicious website could use the extension as a bridge into accounts where the victim was already signed in. Rebora said this could expose emails, documents, enterprise data, browser-stored tokens, and other sensitive information visible through the browser.

The researchers also warned about potential local file exposure in some cases. That path depended on whether the user had granted the extension access to local file URLs, so it was described as conditional rather than guaranteed.

SiderAI flaw abused clicks, typing, and embedded pages

The SiderAI vulnerability, detailed in Rebora’s Spyder technical report, worked differently. Instead of relying on screenshots or tab control, it abused the extension’s ability to embed webpages and trigger artificial user gestures such as clicks and typing.

Rebora called this technique Universal Cross Site Gesturing, or UXSG. The attack could allow a malicious webpage to cause activity inside another logged-in website through the extension’s embedded view.

The researchers demonstrated the risk with an attack path involving Google Gemini. They said a malicious page could force prompts against an authenticated AI session and leak resulting data, including information connected to the logged-in user.

Why AI browser extensions create a larger attack surface

AI side panel extensions often need broad access because they summarize pages, rewrite text, help with email replies, and interact with content across many websites. That makes their permission model especially sensitive.

Google’s Chrome extension security guidance warns that extensions have special privileges inside the browser and can become attractive targets for attackers. It also recommends limiting permissions and restricting external connections to trusted sources.

Rebora’s findings show how a vulnerable extension can turn a normal webpage visit into a browser-level compromise. The user may not need to download a file, enter credentials, or approve a prompt during the attack.

• Attackers could read information from websites where the user is already logged in.
• They could perform actions such as clicking buttons, entering text, or sending prompts.
• They could capture screenshots or interact with hidden browser windows in the MaxAI attack path.
• They could abuse AI tools and workplace apps to extract sensitive information.
• They could create risk for companies if one employee runs a vulnerable extension on a work browser.

Users should remove the extensions or limit exposure

Rebora said it tried to contact the vendors but did not receive a response before publication. The researchers also said Google’s security teams were informed because Google operates the Chrome Web Store, according to the main disclosure.

Until vendors ship confirmed fixes, users should review whether SiderAI or MaxAI is installed in Chrome, Edge, Brave, Vivaldi, or another Chromium-based browser. If the extension is present and not essential, removal is the safest option.

Users who keep either extension should reduce risk by limiting site access where possible, signing out of sensitive services before visiting unknown websites, and avoiding untrusted links. Businesses should treat vulnerable extensions as endpoint risk, not just browser add-ons.

What developers and IT teams should check

Developers building extensions should avoid generic APIs that allow webpages to invoke broad extension behavior. They should validate message origin, message shape, requested action, and destination before any privileged operation runs.

Google’s messaging APIs make extension components powerful, but that power requires strict boundaries. A content script should not blindly forward webpage input to a background process that can access tabs, storage, network controls, or scripting permissions.

The same applies to page access. Chrome content scripts operate close to webpages, and unsafe handling can expose both the extension and the user’s browsing session.

1. Audit installed browser extensions across managed devices.
2. Remove AI side panel extensions that do not have a clear business need.
3. Block or restrict risky extensions through enterprise browser policies.
4. Review extension permissions, especially access to all websites, tabs, storage, and scripting.
5. Monitor for unusual activity in Gmail, Google Workspace, Microsoft 365, cloud storage, and developer tools.
6. Train users to avoid installing extensions only because they are popular or highly rated.

Extension makers should follow Google’s secure extension recommendations by requesting minimal permissions, limiting manifest fields, and restricting external connections. Rebora’s MaxAI analysis and SiderAI analysis also give developers a warning about exposing overly broad internal capabilities to untrusted webpages.

FAQ