EUVD-2026-34168
GHSA-7w3m-2pw9-mg8x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in denial of service on all browsing.
AnalysisAI
Denial of service in Securly Chrome Extension version 3.0.7 allows on-path network attackers to halt all browsing activity by injecting malicious regular expression patterns into an HTTP-delivered configuration file. The extension fetches config.json over plaintext HTTP and compiles attacker-controlled patterns with new RegExp() without complexity checks, enabling catastrophic backtracking (ReDoS). No public exploit identified at time of analysis, and EPSS is very low (0.02%), but the issue is reported by CERT/CC.
Technical ContextAI
The vulnerability is rooted in CWE-1333 (Inefficient Regular Expression Complexity), commonly known as ReDoS. The Securly Chrome Extension (cpe:2.3:a:securly:securly_chrome_extension) retrieves configuration data - specifically pattern lists used for URL filtering/classification - from a remote endpoint over cleartext HTTP rather than HTTPS. Those server-provided strings are passed directly to the JavaScript RegExp constructor and evaluated against page URLs or content. Because JavaScript's regex engine uses backtracking-based NFA matching, certain crafted patterns (e.g., nested quantifiers like (a+)+$) combined with adversarial input cause exponential-time evaluation, freezing the renderer process and effectively blocking the user's browser. The transport-layer weakness (HTTP rather than HTTPS) is what makes the otherwise local trust boundary reachable by any on-path adversary.
RemediationAI
No vendor-released patch identified at time of analysis in the provided data; administrators should monitor the CERT/CC note at https://kb.cert.org/vuls/id/595768 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-8888 for a fixed Chrome Web Store release above 3.0.7. As compensating controls until a patched version ships, force the configuration fetch over HTTPS by deploying enterprise network policies that block or rewrite plaintext HTTP to the Securly config host (side effect: may break the extension if the vendor endpoint does not serve HTTPS), pin the extension's update channel and disable the extension on untrusted networks via Chrome enterprise policy ExtensionInstallBlocklist (side effect: loses Securly's filtering protection while disabled), or route managed devices through a trusted VPN/egress that prevents on-path tampering (side effect: operational overhead and potential latency).
More in Securly Chrome Extension
View allDenial of service in Securly Chrome Extension 3.0.7 allows remote attackers to render all web browsing unusable when the
Information disclosure in Securly Chrome Extension version 3.0.7 allows remote unauthenticated attackers to retrieve SHA
Information disclosure weakness in Securly Chrome Extension version 3.0.7 stems from continued reliance on the deprecate
Cryptographic weakness in Securly Chrome Extension version 3.0.7 and earlier exposes AES-encrypted data to recovery atta
Hardcoded cryptographic secrets in Securly Chrome Extension version 3.0.7 allow remote attackers to decrypt sensitive cr
Cleartext transmission in Securly Chrome Extension version 3.0.7 exposes crisis alert keyword lists and content filterin
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today