AITBM

AIDEFEND IN ACTION · NOT SCORABLE BY DESIGN

Spyder and MaXSS Let Ordinary Webpages Inherit AI Extension Privileges

This source is retained for threat and defensive-evidence research. Its documented limits do not support a separate deployment score at this record's scope.

Use case sources

Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.

Linked library records

Independent products or attack paths are assessed separately. A combined report receives no aggregate score.

Incident overview

Rebora disclosed two different browser-extension privilege crossings in two different products. Spyder abused Sider's synthetic drag and cross-origin gesture path: an attacker page dispatched a dragstart event that triggered Sider's link-preview path and a disable-iframe-restrictions message, Sider embedded Gemini in an iframe after removing response restrictions, and the page then simulated clicks and typing into the authenticated Gemini origin through an open Shadow DOM and the iframe's WindowProxy, ultimately creating and leaking a share link.

MaXSS instead sent a forged page message through MaxAI's content script to a generic privileged background-function bridge: a webpage supplied the expected service ID and a page-settable marker to pass the source check, and the content script forwarded RUN_BACKGROUND_FUNCTION with attacker-chosen browser API names and arguments, exposing tab queries, hidden authenticated tabs, screenshots, and declarative network-rule manipulation leading to universal cross-site scripting. Rebora counted about 11 million Chrome and Edge installations across both products at publication.

On 2026-08-25 AIDEFEND Labs statically inspected store packages: Sider 5.32.2 required isTrusted at the disclosed drag entry and no longer contained the disclosed clickAt handler, while MaxAI 8.37.3 still contained the page-settable marker check and the RUN_BACKGROUND_FUNCTION bridge shape; these are static observations, not a dynamic rerun or vendor confirmation.

Why this analysis has no ERS

The combined item describes two different browser extensions and two unrelated privilege paths. Their separate scores are in product-specific records; the parent retains the source synthesis without an aggregate ERS.

Status: Not scorable by design · Classification: Validated Research · source date 2026-08-25

AIDEFEND evidence routes

AIDEFEND defences → AITBM sub-metrics

Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.

TechniqueDefence PriorityEvidences
AID-H-018.002Policy-Based Access ControlAIDEFEND dataVersion 2026.10.15. Authenticating the caller and origin for every page-to-content-script and content-script-to-background request — so that a synthetic DOM event, shared message ID, or page-settable property cannot establish an extension-owned subject — is the common failure both chains share. This relationship is an evidence route only and supplies no positive score credit without observed control operation.Very HighCn-1 Cn-6 Cn-7
AID-H-017.002Least-Privilege Tool ArchitectureAIDEFEND dataVersion 2026.10.15. Removing a generic browser-API bridge and exposing only single-purpose operations with bounded arguments, tab scope, destinations, and side effects addresses the MaxAI branch specifically. This relationship is an evidence route only and supplies no positive score credit without observed control operation.Very HighCn-5 Cn-7
AID-I-008.002Cross-Origin Read/Write Segmentation with Step-Up ConfirmationAIDEFEND dataVersion 2026.10.15. Binding every cross-origin write to the exact origin and a stable actionable element, re-observing it before execution, and requiring a real trusted gesture addresses the Sider branch specifically. This relationship is an evidence route only and supplies no positive score credit without observed control operation.Very HighPr-2 Cn-1 Cn-4 Cn-7 Cn-8
AID-H-018.005Value-Level Capability Metadata & Data Flow Sink EnforcementAIDEFEND dataVersion 2026.10.15. Treating screenshots, tab metadata, authenticated page content, model responses, and share URLs as sensitive values and preserving that classification across content-script and background-worker messages constrains the data that leaves either boundary. This relationship is an evidence route only and supplies no positive score credit without observed control operation.HighCn-1 Cn-6 Cn-7
AID-H-003.010Deployed AI Software Vulnerability Remediation LifecycleAIDEFEND dataVersion 2026.10.15. Tracking Sider and MaxAI as separate findings with separate reconciliation, dynamic retesting, and closure evidence is the remediation route the brief insists on; the static package observations recorded on 2026-08-25 are explicitly not vendor confirmation. This relationship is an evidence route only and supplies no positive score credit without observed control operation.HighRo-4 Ro-5 Tr-4

Related AITBM rubrics

Cn-1: Scope EnforcementCn-6: Action Reversibility Classification RateCn-7: Resource and Execution-Loop ContainmentCn-5: Agent Identity IntegrityPr-2: Inference Attack ResistanceCn-4: Side-Channel ResistanceCn-8: Untrusted Context IsolationRo-4: Poisoning Attack ResistanceRo-5: Supply-Chain Artifact Admission IntegrityTr-4: Model Lineage Disclosure

Sources