Securly Chrome Extension contains multiple critical flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Securly 3.0.7 for Chromebooks has insecure data transmission, weak cryptography, and broken access controls exposing filtering rules and enabling DoS.
Version 3.0.7 of the Securly Chrome Extension, widely deployed in K–12 school-managed Chromebooks for web filtering and activity monitoring, contains seven distinct vulnerabilities affecting data confidentiality, integrity, and availability. The extension downloads configuration and filtering rules over unencrypted HTTP (CVE-2026-8874, CVE-2026-8888) and uses hardcoded plaintext AES passphrases (CVE-2026-8876) with weak key derivation via MD5 and single-iteration EVP_BytesToKey (CVE-2026-8881). Multiple publicly accessible endpoints expose SHA-1 hashes of blocking rules, inadequately obfuscated with reversible Caesar cipher (CVE-2026-8878). The extension also dynamically registers an undeclared content script that bypasses Chrome Web Store review and can hide all page content indefinitely if servers are unreachable (CVE-2026-8879). Configuration downloads over HTTP lack regex complexity validation, allowing on-path attackers to inject patterns that cause catastrophic backtracking and denial of service across all browsing (CVE-2026-8888). The extension relies on deprecated SHA-1 hashing for CSAM and content-blocking lists (CVE-2026-8889). Collectively, these weaknesses enable network-adjacent attackers to intercept and modify filtering rules, decrypt configuration data, reconstruct blocking logic, and manipulate what content students can access—or prevent access to legitimate educational resources. Securly has not been reached for coordination, and no patch is available.
Mentioned in this report
Detection guidance
Cleartext HTTP Request to Securly Filtering Service Hosts
Flags plain-HTTP requests to Securly-named hosts in proxy logs, the exposure behind the extension's unencrypted config and rule downloads that on-path attackers can tamper with. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cleartext HTTP Request to Securly Filtering Service Hosts
description: Detects unencrypted HTTP (not HTTPS) requests to hosts containing the
vendor name securly in proxy logs. Securly Chrome Extension 3.0.7 downloads configuration
and filtering rules over cleartext HTTP, so these requests mark traffic an on-path
attacker could read or modify, for example to inject catastrophic-backtracking regexes.
Exposure and hygiene detection, not proof of attack. Review hits for the same client
in combination with ARP spoofing or rogue gateway alerts.
tags:
- attack.collection
- attack.credential-access
- attack.t1040
- attack.command-and-control
- attack.t1071.001
logsource:
category: proxy
detection:
selection_host:
cs-host|contains: securly
selection_http:
c-uri|startswith: http://
condition: selection_host and selection_http
falsepositives:
- Managed school devices running the affected extension version that legitimately
fetch configuration over HTTP
- Network monitoring or filtering appliances that probe Securly hosts over HTTP for
health checks
level: low
id: d8dfdc34-5d79-5fb2-8e95-d2946df82942
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/595768
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/595768
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs