What is the CVSS score of CVE-2026-8879?

CVE-2026-8879 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Securly Chrome Extension are affected by CVE-2026-8879?

Securly Chrome Extension 3.0.7 contains a denial-of-service vulnerability that renders all web browsing unusable when the extension's cloud filtering service becomes unreachable.

How to fix or mitigate CVE-2026-8879?

Within 24 hours: Identify all endpoints running Securly Chrome Extension 3.0.7 and document deployment scope. Within 7 days: Downgrade to version 3.0.6 or earlier, or temporarily disable the extension; contact Securly support for patch availability and timeline. Within 30 days: Deploy vendor-released patched version once available, or execute migration to alternative web filtering solution.

Securly Chrome Extension CVE-2026-8879

EUVD-2026-34165 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-06-03 certcc

GHSA-jg8r-xqh5-556r

Authentication Bypass Google Securly Chrome Extension Securly

7.5

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (certcc) · only source for this CVE.

CVSS VectorVendor: certcc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 15:23 vuln.today

CVSS changed

Jun 04, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Jun 03, 2026 - 18:11 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 03, 2026 - 18:11 nvd

HIGH 7.5

DescriptionCVE.org

Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. This script is NOT declared in manifest.json and bypasses Chrome Web Store static security review. It runs on all URLs and immediately hides all page content, creates a full-page overlay, pauses all videos, and only restores content when the service worker confirms the page passes filtering. If Securly's servers are unreachable, pages remain indefinitely hidden.

AnalysisAI

Denial of service in Securly Chrome Extension 3.0.7 allows remote attackers to render all web browsing unusable when the extension's filtering service is unreachable. The extension dynamically registers an undeclared content script (content13.min.js) at runtime via chrome.scripting.registerContentScripts(), hiding every page behind a full-page overlay until the service worker validates the page; if Securly's servers fail or are blocked, pages remain indefinitely blank. No public exploit identified at time of analysis, and EPSS rates exploitation probability at 0.02% (5th percentile).

Technical ContextAI

Securly is a school-oriented web filtering Chrome extension distributed via the Chrome Web Store. The flaw is rooted in CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): rather than declaring its filtering content script in manifest.json - which would subject it to Google's static security review during Chrome Web Store submission - the extension uses chrome.scripting.registerContentScripts() at runtime to inject content13.min.js across all URLs (<all_urls>). The script hides DOM content, overlays the viewport, and pauses media, only releasing the page after the background service worker receives a positive filtering verdict from Securly's backend. This dynamic-injection design pattern circumvents the manifest review pipeline that browser vendors rely on to vet extension behavior.

RemediationAI

No vendor-released patch identified at time of analysis; neither the CERT/CC VU#595768 entry nor the NVD record cite a fixed version. Administrators deploying Securly in managed Chrome environments should monitor https://kb.cert.org/vuls/id/595768 for vendor response and, in the interim, consider compensating controls based on tolerance for the trade-offs: removing or disabling the extension via Google Workspace / Chrome Enterprise policy eliminates the DoS exposure but also removes the intended content filtering (likely unacceptable in K-12 deployments where Securly satisfies CIPA obligations); allowlisting and monitoring availability of Securly's filtering API endpoints (so outages are detected and triaged immediately) mitigates the operational impact without removing the extension; and preparing an emergency Chrome policy push that disables the extension fleet-wide gives operators a quick recovery path if Securly's backend suffers a prolonged outage. Reporting the manifest-bypass behavior to Google's Chrome Web Store team is also warranted since it represents a circumvention of static review.