blogForever Security Research·27 Oct 2026·Gal Weizman

Spyder: Chrome Extension SiderAI Vulnerable to UXSG Puts 10,000,000 Users at Risk

The SiderAI Chrome extension, with 10M installs, lets any website hidden-embed other sites and inject typing and clicks into them, bypassing CSP and frame protections.

Read original on forever.security

vulnerability-research LLM Security web-platform

Depth 4/5Score 5.27

Extract

TL;DR Forever Security Research has discovered a critical vulnerability in the SiderAI Chrome extension. The extension is supported by every Chromium-based browser and is installed on over 10,000,000 devices (According to Chrome and Edge stores). The vulnerability allows any arbitrary website to hiddenly embed any other website and trigger typing and clicking gestures within it. All it takes for the attack to work is visiting a malicious website and having the extension installed and authenticated (no interaction required). The vulnerability allows attackers to: Hiddenly embed any website without adhering to standard security limitations such as Content-Security-Policy, X-Frames-Options, etc. Arbitrarily trigger artificial gestures (typing/clicking) within the embedded website (coined as UXSG=Universal Cross Site Gesturing) This translates to significant impact, allowing attackers to: Access and leak any type of information across any website the victim is logged into. Perform any action on behalf of the user on any website the victim is logged into. Attempts to contact the vendors regarding this vulnerability failed. Given its high severity, we decided to make this information public so users are aware of the risk. Additionally, as the official owner of the Chrome Web Store, Google’s security teams were informed of this. Spyder vulnerability was just one out of two vulnerabilities we found in the scope of this research - read about MaXSS vulnerability here This blog post presents a technical breakdown of this vulnerability. Read the main post here Background To demonstrate the flaw in SiderAI and its impact, it’s first important to understand the product. SiderAI is an agentic side panel, implemented as a standard Chrome extension. This report assumes the reader is familiar with both. If you are not familiar enough with agentic side panels, refer to our agentic side panels cover to learn more. If you are not familiar enough with standard Chrome extensions architecture, refer to our Chrome extensions architecture cover to learn more. Vulnerability The vulnerability is the result of three prominent narratives, which we’ll cover in this report: SiderAI implements the communication channel between webpages and its content-scripts unsafely. SiderAI exposes too much sensitive information to the unprivileged webpage. SiderAI actively weakens websites to make them embeddable, which makes them vulnerable. Unsafe filtering of message events The initial way in was …

Explained

What happened

Forever Security found a flaw in the SiderAI Chrome extension, installed on over 10,000,000 devices, that lets any website secretly drive clicks and keystrokes inside other sites. The authors call it UXSG, universal cross-site gesturing:

SiderAI content script, injected into every page and every iframe, registers a window.message listener with no origin check. It accepts message types like clickAt, type, pressKey and scrollWheel and performs them.
So a malicious page can embed another site in a hidden iframe and inject typing and clicking into it, a Same-Origin Policy bypass from a "write" perspective.
The catch is the target normally has to allow framing. The researchers first demonstrated against Google Workspace, which permits embedding: hide a shared Google Doc in an invisible iframe, use gestures to post a comment, then read which Google account commented to deanonymize the visitor.
To beat sites that refuse framing, they found SiderAI ships an intentional API, disable-iframe-restrictions, that strips the headers (Content-Security-Policy, X-Frame-Options) which block embedding. Combined with the gesture channel, any site can be framed and driven.

Notably, the authors report using Claude to find the header-stripping path and write a working proof of concept.

Why it works

The same two-part failure as its sibling bug: an unauthenticated postMessage channel the page can speak into, plus an over-powerful capability behind it, here synthetic input events. The extra twist is a feature that deliberately removes a site own framing defenses. Once an attacker can both embed a site and send it input, they act as the logged-in user without ever touching that origin directly.

The bigger pattern

This is a confused deputy over an unauthenticated message bridge, the same class as most extension bugs, extended from reading to acting. Framing protections (X-Frame-Options, CSP frame-ancestors) exist precisely to stop clickjacking and cross-origin interaction; an extension that strips them on demand turns a defended site into an embeddable target. Synthetic input dispatch is a capability that should never be reachable by untrusted script, because it defeats the user-gesture and same-origin assumptions the whole web relies on.

What it means in practice

Verify event.origin and event.source on every postMessage handler, and never expose input-synthesis (click, type, key) to messages that can come from the page.
Never build a feature that strips X-Frame-Options or CSP frame-ancestors. Those headers are a security boundary, not an inconvenience.
As a site owner, set frame-ancestors none or a strict allowlist, and do not rely on it alone, since a victim extension can undo it. Add per-action confirmation and re-authentication for sensitive operations.
Treat "agrees to be embedded" surfaces like shared documents as deanonymization vectors; attacker-controlled embeds can link a visitor to their logged-in identity.
For fleets, audit and restrict AI side-panel extensions with broad host permissions. The attack needs only that the victim has the extension installed and is logged in.