EUVD-2026-34161
GHSA-58xm-2wvc-7p7f
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Primary rating from Vendor (certcc) · only source for this CVE.
CVSS VectorVendor: certcc
Lifecycle Timeline
5DescriptionCVE.org
Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS.
AnalysisAI
Cleartext transmission in Securly Chrome Extension version 3.0.7 exposes crisis alert keyword lists and content filtering rules to adjacent network attackers because the extension fetches these JSON configuration files over plaintext HTTP while other endpoints in the same extension correctly use HTTPS. An adjacent attacker on the same network segment can intercept or tamper with the filtering policy data, undermining the safety controls Securly is meant to enforce on managed Chromebooks. No public exploit identified at time of analysis and EPSS is very low at 0.01%, but a vendor patch is available.
Technical ContextAI
Securly is a student-safety content filtering and crisis detection platform deployed widely in K-12 environments, with the Chrome Extension acting as the enforcement point on managed Chromebooks. The vulnerability is a CWE-319 (Cleartext Transmission of Sensitive Information) issue rooted in inconsistent TLS usage within the same extension codebase: the Fetch API call that retrieves crisis alert keywords and filter rule JSON omits the https scheme, while sibling fetches for IWF (Internet Watch Foundation) and CIPA-related data correctly enforce TLS. The CPE confirms the affected component is cpe:2.3:a:securly:securly_chrome_extension across versions up to and including 3.0.7. Because Chrome extensions run with elevated DOM and network capabilities, a tampered policy payload can directly alter what URLs are blocked or which keywords trigger alerts.
RemediationAI
Patch available per vendor advisory - administrators should ensure all managed Chromebooks update the Securly Chrome Extension to a release that succeeds version 3.0.7 and verifies that the crisis alert keyword and filtering rule endpoints are fetched over HTTPS; the CERT/CC note at https://kb.cert.org/vuls/id/595768 and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-8874 should be consulted for the specific fixed build. Because Chrome extension auto-update is the normal delivery channel, force a policy-driven update via Google Admin console rather than relying on user-initiated refresh. As a compensating control until updates propagate, restrict student device network access to trusted SSIDs with client isolation enabled to prevent peer-to-peer LAN attacks (trade-off: may break legitimate local services like printers and AirPlay), and consider deploying an enterprise TLS-inspecting proxy that forces HTTPS upgrades for known Securly endpoints (trade-off: requires CA trust management and may conflict with certificate pinning).
More in Securly Chrome Extension
View allDenial of service in Securly Chrome Extension version 3.0.7 allows on-path network attackers to halt all browsing activi
Denial of service in Securly Chrome Extension 3.0.7 allows remote attackers to render all web browsing unusable when the
Information disclosure in Securly Chrome Extension version 3.0.7 allows remote unauthenticated attackers to retrieve SHA
Information disclosure weakness in Securly Chrome Extension version 3.0.7 stems from continued reliance on the deprecate
Cryptographic weakness in Securly Chrome Extension version 3.0.7 and earlier exposes AES-encrypted data to recovery atta
Hardcoded cryptographic secrets in Securly Chrome Extension version 3.0.7 allow remote attackers to decrypt sensitive cr
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today