CVE-2026-8874

Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://kb.cert.org/vuls/id/595768	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:securly:securly:3.0.7:*:*:*:*:chrome:*:*

History

No history.

Information

Published : 2026-06-03 19:16

Updated : 2026-07-22 20:10

NVD link : CVE-2026-8874

Mitre link : CVE-2026-8874

CVE.ORG link : CVE-2026-8874

JSON object : View

Products Affected

securly

securly

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2026-8874", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8874", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T14:42:14.501953Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Securly", "product": "Securly Chrome Extension", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.7", "versionType": "custom"}]}]}], "published": "2026-06-03T19:16:39.090", "references": [{"url": "https://kb.cert.org/vuls/id/595768", "tags": ["Third Party Advisory"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS."}, {"lang": "es", "value": "La versi\u00f3n 3.0.7 de la extensi\u00f3n de Chrome de Securly descarga archivos JSON que contienen palabras clave de alerta de crisis y reglas de filtrado a trav\u00e9s de HTTP sin cifrar mediante la API Fetch. Otros puntos finales en la misma extensi\u00f3n recuperan correctamente los datos IWF y CIPA a trav\u00e9s de HTTPS, lo que demuestra una implementaci\u00f3n inconsistente de TLS."}], "lastModified": "2026-07-22T20:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:securly:securly:3.0.7:*:*:*:*:chrome:*:*", "vulnerable": true, "matchCriteriaId": "CF6B029B-B152-4A34-AC5B-A417EB476C87"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}