What is the CVSS score of CVE-2026-8888?

CVE-2026-8888 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Securly Chrome Extension are affected by CVE-2026-8888?

Securly Chrome Extension 3.0.7 contains a denial-of-service vulnerability allowing network attackers to inject malicious patterns that halt all user browsing activity.

How to fix or mitigate CVE-2026-8888?

Within 24 hours: Inventory all devices running Securly 3.0.7 and assess exposure in network environments (particularly shared networks or public Wi-Fi endpoints). Within 7 days: Uninstall the vulnerable extension from all affected devices and evaluate alternative security solutions with active patch support. Within 30 days: Establish vendor patch monitoring process and implement network-level HTTP inspection to detect and block malicious config.json delivery attempts.

Securly Chrome Extension CVE-2026-8888

EUVD-2026-34168 HIGH

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-06-03 certcc

GHSA-7w3m-2pw9-mg8x

Denial Of Service Google Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 20:22 vuln.today

CVSS changed

Jun 04, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 03, 2026 - 18:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 03, 2026 - 18:16 nvd

HIGH 7.5

DescriptionCVE.org

Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in denial of service on all browsing.

AnalysisAI

Denial of service in Securly Chrome Extension version 3.0.7 allows on-path network attackers to halt all browsing activity by injecting malicious regular expression patterns into an HTTP-delivered configuration file. The extension fetches config.json over plaintext HTTP and compiles attacker-controlled patterns with new RegExp() without complexity checks, enabling catastrophic backtracking (ReDoS). No public exploit identified at time of analysis, and EPSS is very low (0.02%), but the issue is reported by CERT/CC.

Technical ContextAI

The vulnerability is rooted in CWE-1333 (Inefficient Regular Expression Complexity), commonly known as ReDoS. The Securly Chrome Extension (cpe:2.3:a:securly:securly_chrome_extension) retrieves configuration data - specifically pattern lists used for URL filtering/classification - from a remote endpoint over cleartext HTTP rather than HTTPS. Those server-provided strings are passed directly to the JavaScript RegExp constructor and evaluated against page URLs or content. Because JavaScript's regex engine uses backtracking-based NFA matching, certain crafted patterns (e.g., nested quantifiers like (a+)+$) combined with adversarial input cause exponential-time evaluation, freezing the renderer process and effectively blocking the user's browser. The transport-layer weakness (HTTP rather than HTTPS) is what makes the otherwise local trust boundary reachable by any on-path adversary.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data; administrators should monitor the CERT/CC note at https://kb.cert.org/vuls/id/595768 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-8888 for a fixed Chrome Web Store release above 3.0.7. As compensating controls until a patched version ships, force the configuration fetch over HTTPS by deploying enterprise network policies that block or rewrite plaintext HTTP to the Securly config host (side effect: may break the extension if the vendor endpoint does not serve HTTPS), pin the extension's update channel and disable the extension on untrusted networks via Chrome enterprise policy ExtensionInstallBlocklist (side effect: loses Securly's filtering protection while disabled), or route managed devices through a trusted VPN/egress that prevents on-path tampering (side effect: operational overhead and potential latency).