CVE-2026-8874

Vulnerability

Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. This inconsistent implementation of TLS, while other endpoints correctly use HTTPS, allows for interception of sensitive data [1].

Exploitation

An attacker with network visibility can intercept the unencrypted HTTP traffic to download the JSON files containing crisis alert keywords and filtering rules. This allows for the modification of these rules before they are processed by the extension [1].

Impact

Successful exploitation allows an attacker to modify content blocking rules for student users, potentially leading to the bypass of safety policies or the introduction of malicious content. It can also lead to the theft of configuration information or a Denial of Service (DoS) [1].

Mitigation

No patched version has been disclosed in the available references. Users are advised to monitor for updates from the vendor. The extension is used in K-12 school-managed Chromebooks, highlighting the potential impact on student safety [1].