# Securly Chrome Extension contains multiple critical flaws

Published: 2026-06-03 · Severity: routine · Sectors: education
Canonical: https://vorant.io/reports/1204fb83-5ad5-5a50-badf-7a72311a71e3/securly-chrome-extension-contains-multiple-critical-flaws

> Securly 3.0.7 for Chromebooks has insecure data transmission, weak cryptography, and broken access controls exposing filtering rules and enabling DoS.

Version 3.0.7 of the Securly Chrome Extension, widely deployed in K–12 school-managed Chromebooks for web filtering and activity monitoring, contains seven distinct vulnerabilities affecting data confidentiality, integrity, and availability. The extension downloads configuration and filtering rules over unencrypted HTTP (CVE-2026-8874, CVE-2026-8888) and uses hardcoded plaintext AES passphrases (CVE-2026-8876) with weak key derivation via MD5 and single-iteration EVP_BytesToKey (CVE-2026-8881). Multiple publicly accessible endpoints expose SHA-1 hashes of blocking rules, inadequately obfuscated with reversible Caesar cipher (CVE-2026-8878). The extension also dynamically registers an undeclared content script that bypasses Chrome Web Store review and can hide all page content indefinitely if servers are unreachable (CVE-2026-8879). Configuration downloads over HTTP lack regex complexity validation, allowing on-path attackers to inject patterns that cause catastrophic backtracking and denial of service across all browsing (CVE-2026-8888). The extension relies on deprecated SHA-1 hashing for CSAM and content-blocking lists (CVE-2026-8889). Collectively, these weaknesses enable network-adjacent attackers to intercept and modify filtering rules, decrypt configuration data, reconstruct blocking logic, and manipulate what content students can access—or prevent access to legitimate educational resources. Securly has not been reached for coordination, and no patch is available.

## Mentioned in this report

- Vulnerabilities: CVE-2026-8874, CVE-2026-8876, CVE-2026-8878, CVE-2026-8879, CVE-2026-8881, CVE-2026-8888, CVE-2026-8889

## Detection guidance (public sample)

### Cleartext HTTP Request to Securly Filtering Service Hosts

ATT&CK: T1071.001

Flags plain-HTTP requests to Securly-named hosts in proxy logs, the exposure behind the extension's unencrypted config and rule downloads that on-path attackers can tamper with. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cleartext HTTP Request to Securly Filtering Service Hosts
description: Detects unencrypted HTTP (not HTTPS) requests to hosts containing the
  vendor name securly in proxy logs. Securly Chrome Extension 3.0.7 downloads configuration
  and filtering rules over cleartext HTTP, so these requests mark traffic an on-path
  attacker could read or modify, for example to inject catastrophic-backtracking regexes.
  Exposure and hygiene detection, not proof of attack. Review hits for the same client
  in combination with ARP spoofing or rogue gateway alerts.
tags:
- attack.collection
- attack.credential-access
- attack.t1040
- attack.command-and-control
- attack.t1071.001
logsource:
  category: proxy
detection:
  selection_host:
    cs-host|contains: securly
  selection_http:
    c-uri|startswith: http://
  condition: selection_host and selection_http
falsepositives:
- Managed school devices running the affected extension version that legitimately
  fetch configuration over HTTP
- Network monitoring or filtering appliances that probe Securly hosts over HTTP for
  health checks
level: low
id: d8dfdc34-5d79-5fb2-8e95-d2946df82942
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/595768
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/595768

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1204fb83-5ad5-5a50-badf-7a72311a71e3/securly-chrome-extension-contains-multiple-critical-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup