What is the CVSS score of CVE-2026-8876?

CVE-2026-8876 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Securly Chrome Extension are affected by CVE-2026-8876?

Securly Chrome Extension version 3.0.7 contains hardcoded encryption keys enabling unauthorized decryption of student crisis detection and intervention data, potentially compromising the integrity of…

How to fix or mitigate CVE-2026-8876?

Within 24 hours: Audit all devices running Securly Chrome Extension 3.0.7 and quantify deployment scope across your organization. Within 7 days: Contact Securly for patching timeline; simultaneously evaluate network-based content filtering as compensating control or begin procurement of alternative student monitoring solutions. Within 30 days: Either deploy vendor patch upon release or complete migration to alternative student safety solutions with current cryptographic standards.

Securly Chrome Extension CVE-2026-8876

EUVD-2026-34162 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-06-03 certcc

GHSA-ph4h-q38c-6xg4

Google Authentication Bypass Chrome

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 15:22 vuln.today

CVSS changed

Jun 04, 2026 - 15:22 NVD

7.3 (HIGH)

CVE Published

Jun 03, 2026 - 18:07 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 03, 2026 - 18:07 nvd

HIGH 7.3

DescriptionCVE.org

Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data.

AnalysisAI

Hardcoded cryptographic secrets in Securly Chrome Extension version 3.0.7 allow remote attackers to decrypt sensitive crisis alert keyword lists and intervention site data shipped with the extension. The plaintext AES passphrases embedded in securly.min.js can be extracted by anyone who installs or inspects the extension, exposing the proprietary detection logic used to safeguard students. No public exploit has been identified at time of analysis, and EPSS rates exploitation probability at 0.02% (4th percentile), but the trivial extractability of the keys means any motivated actor can replicate the disclosure.

Technical ContextAI

Securly is a student-safety platform whose Chrome Extension is widely deployed in K-12 environments to monitor browsing and detect self-harm or violence indicators. The extension's client-side JavaScript bundle (securly.min.js) ships with AES symmetric passphrases stored as plaintext string literals, used to decrypt two assets distributed with the extension: the crisis keyword corpus and the intervention site list. This is the textbook 'Use of Hard-coded Cryptographic Key' weakness (CWE-321/CWE-798) - although the input lists CWE as N/A, the described pattern matches that class. Because Chrome extensions are unpacked client-side, any installer or browser DevTools user can read the bundle, defeating the obfuscation the encryption was intended to provide.

RemediationAI

No vendor-released patch identified at time of analysis - neither the input nor the CERT/CC reference cites a fixed Securly Chrome Extension build, so administrators should monitor https://kb.cert.org/vuls/id/595768 and the Chrome Web Store listing for an update past 3.0.7 and apply it via managed-extension policy as soon as available. As a compensating control, organizations that have already extracted the keyword corpus and rely on its secrecy should treat the keyword list as publicly known and supplement client-side detection with server-side or network-side analysis that does not depend on the extracted keys; this preserves coverage but increases backend processing cost. Disabling auto-update is not recommended because future fixes will arrive via that channel, but you can pin to a forthcoming fixed version once released. Direct affected users to Securly support to confirm a remediation timeline, and review any cached copies of the extension bundle within your environment to ensure they are not redistributed.