EUVD-2026-34165
GHSA-jg8r-xqh5-556r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. This script is NOT declared in manifest.json and bypasses Chrome Web Store static security review. It runs on all URLs and immediately hides all page content, creates a full-page overlay, pauses all videos, and only restores content when the service worker confirms the page passes filtering. If Securly's servers are unreachable, pages remain indefinitely hidden.
AnalysisAI
Denial of service in Securly Chrome Extension 3.0.7 allows remote attackers to render all web browsing unusable when the extension's filtering service is unreachable. The extension dynamically registers an undeclared content script (content13.min.js) at runtime via chrome.scripting.registerContentScripts(), hiding every page behind a full-page overlay until the service worker validates the page; if Securly's servers fail or are blocked, pages remain indefinitely blank. No public exploit identified at time of analysis, and EPSS rates exploitation probability at 0.02% (5th percentile).
Technical ContextAI
Securly is a school-oriented web filtering Chrome extension distributed via the Chrome Web Store. The flaw is rooted in CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): rather than declaring its filtering content script in manifest.json - which would subject it to Google's static security review during Chrome Web Store submission - the extension uses chrome.scripting.registerContentScripts() at runtime to inject content13.min.js across all URLs (<all_urls>). The script hides DOM content, overlays the viewport, and pauses media, only releasing the page after the background service worker receives a positive filtering verdict from Securly's backend. This dynamic-injection design pattern circumvents the manifest review pipeline that browser vendors rely on to vet extension behavior.
RemediationAI
No vendor-released patch identified at time of analysis; neither the CERT/CC VU#595768 entry nor the NVD record cite a fixed version. Administrators deploying Securly in managed Chrome environments should monitor https://kb.cert.org/vuls/id/595768 for vendor response and, in the interim, consider compensating controls based on tolerance for the trade-offs: removing or disabling the extension via Google Workspace / Chrome Enterprise policy eliminates the DoS exposure but also removes the intended content filtering (likely unacceptable in K-12 deployments where Securly satisfies CIPA obligations); allowlisting and monitoring availability of Securly's filtering API endpoints (so outages are detected and triaged immediately) mitigates the operational impact without removing the extension; and preparing an emergency Chrome policy push that disables the extension fleet-wide gives operators a quick recovery path if Securly's backend suffers a prolonged outage. Reporting the manifest-bypass behavior to Google's Chrome Web Store team is also warranted since it represents a circumvention of static review.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today