Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Linked library records
Independent products or attack paths are assessed separately. A combined report receives no aggregate score.
Original report record: Spyder and MaXSS Let Ordinary Webpages Inherit AI Extension Privileges.
Forever Security demonstrated that an attacker page could dispatch a synthetic drag event to Sider, causing it to embed an authenticated Gemini page after weakening iframe restrictions. Through an open shadow root and WindowProxy, the attacker drove clicks and typing, created a Gemini share link, and leaked the resulting content in a controlled demonstration.
ASSESSED SYSTEM
Representative authenticated Sider AI browser-extension session in the vulnerable configuration reported June 10, 2026, when a user visits an attacker-controlled page.
OUT OF SCOPE
No claim of a real-world victim compromise, every Sider release, or impact after code changes AIDEFEND later observed statically in version 5.32.2. Generic browser powers outside the demonstrated Gemini path are not scored.
Architecture: Tool-Calling LLM / Connected GenAI (decision tree Q3) — Q2 autonomous planning is not the documented failure. Q3 applies because the AI browser extension exposes connected browser actions and privileged bridge operations in the user session. Tier 2: Tier 2 representative public-facing service scenario; the original source does not establish every operator tier.
Documented attack or failure path
- A user with Sider installed and authenticated visited an attacker-controlled webpage.
- The page sent a synthetic drag event; Sider embedded Gemini after disabling frame restrictions.
- The page used the exposed frame bridge to type and click in Gemini, then leaked a share link in the researcher test.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The researcher abandoned a separate pop-up path because it required a real user gesture; that limitation is not scored as protection for the demonstrated iframe path.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.88 (midpoint 0.44), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.00w 0.12 | The page exceeded its authorized origin and action scope through the extension without an effective gesture boundary, matching Cn-1 0.00. | The original researcher showed an ordinary page driving Sider-owned cross-origin gesture actions inside an authenticated Gemini session.source: primary report |
Unknown, not N/A: 25 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.50w 0.25 | Representative activity level for the documented bounded AI path; deployment-specific autonomy was not measured. |
| AsAttack Surface Exposure | 0.75w 0.35 | Representative exposure of the documented entry path; this is a scenario assumption and not a census of all operators. |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph or DGC is published, so framework worst-case Cp default applies.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.50w 0.20 | A specific patch or configuration change is documented; repair feasibility is an inferred representative scenario, not measured recovery time. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Minimal public provenance identifies the affected path but supplies no operator assessment pack, signed configuration inventory, or repeated metric battery. |
| Ec — Public evaluation coverage | 0.03 | coverage 0.04 (1 of 26 applicable sub-metrics) × independence 0.80 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.37 | Evidence dated 2026-06-10; age 130 days on the workpaper reference date. Components: T_calendar 0.37 · C_monitor 0.60. Binding term: T_calendar. Evidence reference is 2026-10-18, 130 days after earliest substantive public evidence (2026-06-10). C_monitor uses the conservative Tier 2 public-evidence default because usable monitoring-coverage evidence is unavailable; it does not assert no deployment telemetry. No C_event cap is asserted from research or an advisory without a dated victim incident. No generic C_evidence cap is assigned from missing public inputs. Indicative ERS uses normalized ACI = 1.00 for comparison only. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.14 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.0 midpoint, interval 1.1–6.9; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 1 record
Spyder-Sider-research CVSS 10.0 (version and metric group not stated by source) Critical
| Published score | 10.0 |
|---|---|
| CVSS version | not stated by source |
| Metric group | not stated by source |
| Severity | Critical |
| Vector | not stated by source |
| Scored by | Forever Security Research |
| Source record | https://forever.security/blog/spyder-vulnerability-in-chrome-extension-leads-to-uxsg (accessed 2026-10-18) |
| Affected component | Sider AI browser extension cross-origin gesture path |
| Scope note | The researcher-published CVSS3 10 claim covers the exact browser extension path assessed here. |
| Source note | The original researcher labels the score CVSS3 10 but does not publish a minor version or full vector. |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
WHAT THIS CASE TEACHES
Forever Security demonstrated that an attacker page could dispatch a synthetic drag event to Sider, causing it to embed an authenticated Gemini page after weakening iframe restrictions. Through an open shadow root and WindowProxy, the attacker drove clicks and typing, created a Gemini share link, and leaked the resulting content in a controlled demonstration.
Sources: Original primary report