What is the CVSS score of CVE-2026-8874?

CVE-2026-8874 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Securly Chrome Extension are affected by CVE-2026-8874?

The Securly Chrome Extension version 3.0.7 and earlier transmits content filtering and crisis alert configurations over unencrypted HTTP, allowing adjacent network attackers to intercept and modify…. A patch is available.

How to fix or mitigate CVE-2026-8874?

Within 24 hours: Identify all Securly Chrome Extension deployments across your Chromebook fleet and document current versions in use; contact Securly support for the patched version addressing CVE-2026-8874. Within 7 days: Test the vendor patch in a non-production environment to confirm proper content filtering operation; verify through network analysis that policy updates now use HTTPS. Within 30 days: Complete rollout of the patched version to all managed Chromebooks and retire any devices unable to run the latest extension version.

Securly Chrome Extension CVE-2026-8874

EUVD-2026-34161 HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2026-06-03 certcc

GHSA-58xm-2wvc-7p7f

Information Disclosure Google Chrome

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 16:22 vuln.today

CVSS changed

Jun 04, 2026 - 16:22 NVD

7.1 (HIGH)

Patch available

Jun 03, 2026 - 20:01 EUVD

CVE Published

Jun 03, 2026 - 18:03 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 03, 2026 - 18:03 nvd

HIGH 7.1

DescriptionCVE.org

Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS.

AnalysisAI

Cleartext transmission in Securly Chrome Extension version 3.0.7 exposes crisis alert keyword lists and content filtering rules to adjacent network attackers because the extension fetches these JSON configuration files over plaintext HTTP while other endpoints in the same extension correctly use HTTPS. An adjacent attacker on the same network segment can intercept or tamper with the filtering policy data, undermining the safety controls Securly is meant to enforce on managed Chromebooks. No public exploit identified at time of analysis and EPSS is very low at 0.01%, but a vendor patch is available.

Technical ContextAI

Securly is a student-safety content filtering and crisis detection platform deployed widely in K-12 environments, with the Chrome Extension acting as the enforcement point on managed Chromebooks. The vulnerability is a CWE-319 (Cleartext Transmission of Sensitive Information) issue rooted in inconsistent TLS usage within the same extension codebase: the Fetch API call that retrieves crisis alert keywords and filter rule JSON omits the https scheme, while sibling fetches for IWF (Internet Watch Foundation) and CIPA-related data correctly enforce TLS. The CPE confirms the affected component is cpe:2.3:a:securly:securly_chrome_extension across versions up to and including 3.0.7. Because Chrome extensions run with elevated DOM and network capabilities, a tampered policy payload can directly alter what URLs are blocked or which keywords trigger alerts.

RemediationAI

Patch available per vendor advisory - administrators should ensure all managed Chromebooks update the Securly Chrome Extension to a release that succeeds version 3.0.7 and verifies that the crisis alert keyword and filtering rule endpoints are fetched over HTTPS; the CERT/CC note at https://kb.cert.org/vuls/id/595768 and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-8874 should be consulted for the specific fixed build. Because Chrome extension auto-update is the normal delivery channel, force a policy-driven update via Google Admin console rather than relying on user-initiated refresh. As a compensating control until updates propagate, restrict student device network access to trusted SSIDs with client isolation enabled to prevent peer-to-peer LAN attacks (trade-off: may break legitimate local services like printers and AirPlay), and consider deploying an enterprise TLS-inspecting proxy that forces HTTPS upgrades for known Securly endpoints (trade-off: requires CA trust management and may conflict with certificate pinning).