EUVD-2026-34163
GHSA-wwcp-6f37-8chw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (certcc) · only source for this CVE.
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible endpoints that allow unauthenticated access to sensitive data. The exposed information consists of SHA-1 hashes that are inadequately obfuscated using a simple Caesar cipher, which can be easily reversed to recover the original hash values and access the protected data.
AnalysisAI
Information disclosure in Securly Chrome Extension version 3.0.7 allows remote unauthenticated attackers to retrieve SHA-1 hashes via publicly accessible endpoints, where the hashes are weakly protected by a reversible Caesar cipher. The flaw enables recovery of sensitive identifiers protecting filtered content data, with no public exploit identified at time of analysis and an EPSS score of 0.02% indicating very low predicted exploitation activity.
Technical ContextAI
Securly is a cloud-based web filtering and student safety platform widely deployed in K-12 education environments, and its Chrome Extension enforces content filtering policies on managed Chromebooks. The vulnerability stems from two compounding weaknesses: exposure of backend endpoints without authentication (an access control failure analogous to CWE-306 Missing Authentication) and use of a Caesar cipher - a trivially reversible classical substitution scheme - to obscure SHA-1 hash values returned by those endpoints (analogous to CWE-327 Use of a Broken or Risky Cryptographic Algorithm). SHA-1 itself is also deprecated for security-sensitive use, and layering a Caesar cipher over it provides no meaningful confidentiality. The affected component is identified by CPE cpe:2.3:a:securly:securly_chrome_extension:*:*:*:*:*:*:*:*.
RemediationAI
No vendor-released patch identified at time of analysis from the supplied references; administrators should monitor the CERT/CC note at https://kb.cert.org/vuls/id/595768 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-8878 for an updated extension version above 3.0.7 and deploy it via Google Admin console managed-extension policies as soon as it is published. As compensating controls until a fixed build is available, organizations can pin or restrict the Securly extension's allowed network destinations using Chrome enterprise policy (URLBlocklist/URLAllowlist) to prevent client traffic to the exposed endpoints - with the trade-off that filtering features depending on those endpoints may degrade - or temporarily remove the extension from sensitive user populations and rely on alternative DNS/network-layer filtering, accepting reduced per-user policy granularity. Network egress filtering at the school or organizational firewall can also be used to block direct access to the affected Securly backend hosts from non-managed devices, reducing the population that can trigger the disclosure.
More in Securly Chrome Extension
View allDenial of service in Securly Chrome Extension version 3.0.7 allows on-path network attackers to halt all browsing activi
Denial of service in Securly Chrome Extension 3.0.7 allows remote attackers to render all web browsing unusable when the
Information disclosure weakness in Securly Chrome Extension version 3.0.7 stems from continued reliance on the deprecate
Cryptographic weakness in Securly Chrome Extension version 3.0.7 and earlier exposes AES-encrypted data to recovery atta
Hardcoded cryptographic secrets in Securly Chrome Extension version 3.0.7 allow remote attackers to decrypt sensitive cr
Cleartext transmission in Securly Chrome Extension version 3.0.7 exposes crisis alert keyword lists and content filterin
Same weakness CWE-326 – Inadequate Encryption Strength
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today