Skip to content
OpenAdvisories

Vendor

Securly

7 known vulnerabilities.

Securly at a glance

Last 12 months
7
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 7 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202670
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Securly Chrome Extension 7
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 7.5
    CVE-2026-8888 Public exploit

    CVE-2026-8888

    Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause cat…

    Securly Securly Chrome Extension Browsers
  • High 7.5
    CVE-2026-8889

    CVE-2026-8889

    Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashes) and CIPA blocklist matching (12,352 hashes).

    Securly Securly Chrome Extension Browsers
  • High 7.5
    CVE-2026-8881

    CVE-2026-8881

    Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. MD5 has been broken since 2004 and a single iteration provides no key stretching.

    Securly Securly Chrome Extension Browsers
  • High 7.5
    CVE-2026-8879

    CVE-2026-8879

    Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. This script is NOT declared in manifest.json and bypasses Chrome Web Store static security revie…

    Securly Securly Chrome Extension Browsers
  • High 7.5
    CVE-2026-8878

    CVE-2026-8878

    Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible endpoints that allow unauthenticated access to sensitive data. The exposed information consists of SHA-1 hashes that are inadequately obfuscated using a simple Caesar cipher, w…

    Securly Securly Chrome Extension Browsers
  • High 7.3
    CVE-2026-8876

    CVE-2026-8876

    Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data.

    Securly Securly Chrome Extension Browsers
  • High 7.1
    CVE-2026-8874

    CVE-2026-8874

    Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating …

    Securly Securly Chrome Extension Browsers