I replaced my TV with this Google TV Projector – and it’s $500 off for Prime Day


XGIMI Horizon 20 Max 4K projector on ground.

Prakhar Khanna/ZDNET

Xgimi announced the Horizon 20 Max flagship projector at IFA 2025, as the brightest 4K projector in its range at the time. The company said it was “perfect for viewers who want immersive visuals even in daylight or high-ambient light environments,” as this level of brightness is usually found on projectors designed for large spaces that cost more than double the price. Earlier this year, I put these claims to the test by using it as a TV replacement in the living room.

A few months later, I haven’t looked back. It is still my go-to movie-watching device, and thankfully, it’s now down to $2,199 for the Amazon Prime Day sale. That’s a hefty $800 off from the launch price and a comfortable $500 discount over the typical sale price of $2,699.

Also: It’s Prime Day: Our editors hand-picked the 90+ best deals and are tracking them live

I love it for the size and picture quality

My living room doesn’t have the space to place a wide short-throw projector, nor do I want to permanently mount one to my ceiling. The Xgimi Horizon 20 Max is geared toward people like me, who want a non-permanently mounted home-use projector, so it is movable when needed.

The Xgimi projector has a built-in gimbal system, which allows me to place it where I want and adjust the horizontal and vertical alignment from there. It features both horizontal and vertical lens shift, alongside motorized zoom (with a range of about 3 feet between its minimum and maximum throw). These features combine to offer a fast and easy setup for movie nights.

Inside the Horizon 20 Max sits a triple-laser 4K DLP optical engine architecture to deliver a claimed brightness of 5,700 ISO lumens, which is very bright for its size. It supports Dolby Vision, HDR10+, Filmmaker Mode, IMAX Enhanced, and DTS:X for a more immersive feel. It runs Google TV, which allows you to install any streaming service you want. And unlike the previous-generation Horizon S Max, you also get native Netflix support. 

But what’s all that brightness if the colors aren’t accurate? Fortunately, in this case, the Xgimi projector delivers a pleasing contrast ratio (claimed 20,000:1) and accurate colors, resulting in a delightful experience for the most part. It offers easy access presets for both bright and dark room setups.

Also: The best Prime Day TV deals actually worth your time: Samsung, Sony, and more

For example, the Movie preset (great for dark rooms) gives you a warmer tone as compared to the High Brightness picture preset, which can make things excessively bright, sometimes washing out the colors. While I did notice the rainbow effect in certain scenes, it wasn’t distracting enough to spoil my movie nights. On the other hand, the Vivid preset adds decent saturation, whereas the Standard mode keeps the color tone subtly flatter. Both of these modes look vibrant in dark rooms.

It also has a low-latency gaming mode with a claimed 1ms input lag, a 240Hz refresh rate, and VRR. I’m not a gamer and don’t own a console, so I couldn’t put these claims to the test. Notably, its 1ms input lag is limited to 1080p at 240Hz, which increases to 2.2ms in 1080p at 120Hz and 3ms in 4K at 60Hz output.

I/O ports on the XGIMI Horizon 20 Max projector.

It can get slightly noisy in full throttle mode.

Prakhar Khanna/ZDNET

The I/O options on the flagship Xgimi projector include 2x HDMI ports (one with eARC support to connect a soundbar), 2x USB ports, an optical digital audio output, and a 3.5mm audio line out. Its excellent picture quality is paired with 24W Harman/Kardon drivers for audio, which sounded impressively loud for my decently-sized living room. The bass is better than before, which is to say, it is deeper and free of distortions. I only noticed muffled dialogues on deep male voices on a few occasions, but apart from that, the speaker system remains reliable.

At the original $3,000 price, the Xgimi Horizon 20 Max was an expensive projector, which I wouldn’t have recommended as easily. However, with a $500 discount over the current sale price of $2,699, it is a more tempting deal. For $2,199, you’re getting a projector that’s as bright as a TV, delivers accurate colors with good contrast, and has flexible placement options, thanks to a built-in gimbal. This deal is now live and available till June 30, 2026.

How I rated this deal 

According to our deal-rating system, this 19% off deal should be rated 2/5, but since it is an impressive projector with a sale price lower than its initial early-bird offering ($2,399), I gave it a 3/5 deal you don’t want to miss out on. 

When is Amazon Prime Day?

Amazon Prime Day runs this week until the end of Friday, June 26. However, we usually see lingering deals a day or two after the event, but don’t count on seeing remaining discounts on big-name brands after the event ends. 

When will this deal expire?

XGIMI says this deal will run through June 23 – June 30, 2026. However, it depends on the stock availability. If it gets sold out before June 30, the deal will expire earlier.

How do we rate deals at ZDNET?

We aim to deliver the most accurate advice to help you shop smarter. ZDNET offers 33 years of experience, 30 hands-on product reviewers, and 10,000 square feet of lab space to ensure we bring you the best of tech.

Last year, we refined our approach to deals, developing a measurable system for sharing savings with readers like you. Our editor’s deal rating badges are affixed to most of our deal content, making it easy to interpret our expertise to help you make the best purchase decision.

At the core of this approach is a percentage-off-based system to classify savings offered on top-tech products, combined with a sliding-scale system based on our team members’ expertise and several factors like frequency, brand or product recognition, and more. The result? Hand-crafted deals chosen specifically for ZDNET readers like you, fully backed by our experts.

Also: How we rate deals at ZDNET in 2026





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)







Source link