Loading story…
Rebora Security disclosed two critical vulnerabilities, Spyder and MaXSS, in the AI browser extensions SiderAI and MaxAI, which are installed on more than 10 million Chrome-compatible browsers. The flaws stem from insecure message handling and unsafe extension-to-webpage interactions, allowing a malicious site to compromise a victim’s browser session with no user action beyond visiting a page. Researchers said the bugs affect the broader Chromium-based browser ecosystem because both extensions are supported across Chrome-like browsers.
The reported impact includes execution of privileged extension actions such as opening hidden tabs, taking screenshots, accessing active Gmail and Google Calendar sessions, simulating clicks and keystrokes, stealing AI chat histories, and leaking shareable links. Rebora Security said MaxAI could be abused to perform arbitrary extension actions, while SiderAI could be manipulated to extract private conversations from services including Google Gemini. The researchers said they notified the vendors and Google, but the vendors had not patched the issues or responded before disclosure, prompting recommendations that users remove the extensions and review other installed browser add-ons for similar risk.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Rebora Security reported the Spyder and MaXSS vulnerabilities affecting the SiderAI and MaxAI browser extensions to the vendors and also notified Google. The report says the vendors did not respond before the public disclosure.
Following disclosure, security experts advised users to review installed browser extensions and remove SiderAI and MaxAI if present. At the time of reporting, the vulnerabilities had not been patched by the vendors.
Rebora Security disclosed two critical vulnerabilities, Spyder and MaXSS, in the AI browser extensions SiderAI and MaxAI, which are installed on more than 10 million devices. The flaws allow malicious websites to abuse insecure extension-to-webpage messaging to perform privileged actions and steal sensitive data with no user interaction beyond visiting a page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcerebora.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple risks tied to **AI-themed browser extensions** in the Chrome/Edge ecosystem, including active malicious campaigns. Malwarebytes identified **16 malicious extensions** (15 Chrome, 1 Edge) masquerading as ChatGPT “enhancers” that **steal ChatGPT session tokens**, enabling attackers to take over accounts and access conversation history and metadata; the extensions also exfiltrate additional telemetry (e.g., extension version/language and usage details) to help attackers profile victims and maintain longer-term access. Separately, Varonis described a new **malware-as-a-service** offering called **“Stanley”** that claims to reliably get **phishing-capable Chrome extensions** through Chrome Web Store review, using full-screen `iframe` overlays to present attacker-controlled login pages while the address bar continues to show the legitimate domain; it also advertises auto-install support across Chrome/Edge/Brave, a management panel, geo/IP targeting, and frequent C2 polling. In parallel with these overtly malicious cases, an Incogni study of **442 AI-powered Chrome extensions** found broad privacy and security exposure from over-privileged extensions (e.g., script injection and deep page access) and extensive data collection (52% collecting user data), highlighting that even popular tools (e.g., **Grammarly** and **QuillBot**) can present significant privacy risk due to the scope of permissions and data categories collected.
Jun 29, 2026
Researchers and vendors have disclosed serious security weaknesses in AI-enabled browsers, warning that agentic features can undermine core browser protections such as the same-origin policy, tab isolation, and safe handling of cross-origin content. A study cited by *Live Science* found inconsistent security behavior across seven AI browsers and concluded that more capable products often introduced greater risk, including exposure through prompt injection, multi-tab visibility, and unsafe memory handling. Brave separately detailed indirect prompt injection risks in its discussion of Perplexity Comet, highlighting how malicious web content can manipulate browser agents through embedded instructions. A separate vulnerability chain in OpenAI’s ChatGPT Atlas browser showed how these design risks can translate into account-compromise scenarios. According to Hacktron AI, exposed Chromium Mojo IPC interfaces were reachable from broadly allowlisted OpenAI web origins, and researchers chained a `postMessage`-based XSS on `forums.openai.com` with a login CSRF flaw to execute JavaScript on an authenticated OpenAI domain. From there, they were able to control Atlas browser functions, enumerate and manipulate tabs, and continuously read live tab URLs, enabling theft of OAuth authorization codes that could lead to takeover of accounts such as GitHub, Reddit, and Facebook. OpenAI said it fixed the issue in Atlas version `1.2025.288.15` and awarded a $5,000 bounty.
Jul 24, 2026
Researchers reported that several AI-themed browser extensions in official marketplaces covertly harvested user conversations from generative AI services including **ChatGPT, Claude, Copilot, Gemini, and DeepSeek**. G Data identified **Urban VPN**, **Smart Sidebar: ChatGPT, Claude and DeepSeek**, and **AI Assistant/Chat AI** as examples that remained outwardly functional while injecting scripts, intercepting requests, tampering with page content, or using hidden iframes to capture prompts and responses from visited AI sites. Investigators said the stolen data included conversation IDs, hostnames, timestamps, and full chat histories, with some payloads encoded in Base64 and sent to external servers. The extensions reportedly had strong ratings, large user bases, and in one case a Chrome Web Store **Featured** badge, underscoring how official store vetting can miss dynamic malicious behavior such as remote iframe communications; researchers warned that AI-focused extensions now expose a broad attack surface and urged enterprises to enforce strict extension allow-listing, minimize permissions, and remove unnecessary add-ons from systems accessing sensitive AI platforms.
Jun 29, 2026