What is the CVSS score of CVE-2026-8878?

CVE-2026-8878 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Securly Chrome Extension are affected by CVE-2026-8878?

Securly Chrome Extension version 3.0.7 exposes sensitive filtering policy identifiers to unauthenticated internet users through weakly protected public endpoints, with no public exploit identified at…

How to fix or mitigate CVE-2026-8878?

Within 24 hours: Identify all Securly Chrome Extension installations across your organization and assess deployment scope. Within 7 days: Contact Securly support for patch timeline; implement temporary mitigations such as network-level access controls to Securly endpoints or extension disablement on critical systems. Within 30 days: Deploy patched version of Securly Chrome Extension when vendor releases it; if patch unavailable by day 30, accelerate evaluation of alternative content filtering solutions.

Securly Chrome Extension CVE-2026-8878

EUVD-2026-34163 HIGH

Inadequate Encryption Strength (CWE-326)

2026-06-03 certcc

GHSA-wwcp-6f37-8chw

Information Disclosure Google Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 15:23 vuln.today

CVSS changed

Jun 04, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Jun 03, 2026 - 18:09 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 03, 2026 - 18:09 nvd

HIGH 7.5

DescriptionCVE.org

Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible endpoints that allow unauthenticated access to sensitive data. The exposed information consists of SHA-1 hashes that are inadequately obfuscated using a simple Caesar cipher, which can be easily reversed to recover the original hash values and access the protected data.

AnalysisAI

Information disclosure in Securly Chrome Extension version 3.0.7 allows remote unauthenticated attackers to retrieve SHA-1 hashes via publicly accessible endpoints, where the hashes are weakly protected by a reversible Caesar cipher. The flaw enables recovery of sensitive identifiers protecting filtered content data, with no public exploit identified at time of analysis and an EPSS score of 0.02% indicating very low predicted exploitation activity.

Technical ContextAI

Securly is a cloud-based web filtering and student safety platform widely deployed in K-12 education environments, and its Chrome Extension enforces content filtering policies on managed Chromebooks. The vulnerability stems from two compounding weaknesses: exposure of backend endpoints without authentication (an access control failure analogous to CWE-306 Missing Authentication) and use of a Caesar cipher - a trivially reversible classical substitution scheme - to obscure SHA-1 hash values returned by those endpoints (analogous to CWE-327 Use of a Broken or Risky Cryptographic Algorithm). SHA-1 itself is also deprecated for security-sensitive use, and layering a Caesar cipher over it provides no meaningful confidentiality. The affected component is identified by CPE cpe:2.3:a:securly:securly_chrome_extension:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied references; administrators should monitor the CERT/CC note at https://kb.cert.org/vuls/id/595768 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-8878 for an updated extension version above 3.0.7 and deploy it via Google Admin console managed-extension policies as soon as it is published. As compensating controls until a fixed build is available, organizations can pin or restrict the Securly extension's allowed network destinations using Chrome enterprise policy (URLBlocklist/URLAllowlist) to prevent client traffic to the exposed endpoints - with the trade-off that filtering features depending on those endpoints may degrade - or temporarily remove the extension from sensitive user populations and rely on alternative DNS/network-layer filtering, accepting reduced per-user policy granularity. Network egress filtering at the school or organizational firewall can also be used to block direct access to the affected Securly backend hosts from non-managed devices, reducing the population that can trigger the disclosure.