TI-2026-07798 CVE-2026-8876 · GHSA-ph4h-q38c-6xg4
Hard-coded credentials in Securly Chrome Extension
Priority MEDIUM 40
Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js.
Securly
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9
Exploited now
Securly records in CISA KEVNo Securly vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2026-07810 CVE-2026-8888 · GHSA-7w3m-2pw9-mg8x
Regular expression denial of service in Securly Chrome Extension
Priority LOW 39
Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation.
TI-2026-07801 CVE-2026-8879 · GHSA-jg8r-xqh5-556r
Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a…
Priority LOW 39
Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime.
TI-2026-07811 CVE-2026-8889 · GHSA-7qqf-r2pg-xhqj
Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM…
Priority LOW 38
Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashes) and CIPA blocklist matching (12,352 hashes).
TI-2026-07803 CVE-2026-8881 · GHSA-p539-q9q2-vqr2
Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5…
Priority LOW 38
Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption.
TI-2026-07800 CVE-2026-8878 · GHSA-wwcp-6f37-8chw
Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible…
Priority LOW 38
Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible endpoints that allow unauthenticated access to sensitive data.
TI-2026-07796 CVE-2026-8874 · GHSA-58xm-2wvc-7p7f
Cleartext transmission of sensitive information in Securly Chrome Extension
Priority LOW 30
Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API.