CVE-2026-8876: Hardcoded AES Keys in Securly Chrome Extension 3.0.7

Technical summary

CVE-2026-8876 involves the exposure of plaintext AES passphrases within securly.min.js in Securly Chrome Extension version 3.0.7. These hardcoded credentials are used to decrypt two categories of sensitive configuration data: crisis alert keyword definitions and intervention site lists. The vulnerability falls under CWE-798 (Use of Hardcoded Credentials). An attacker who obtains the extension code—either through direct inspection, decompilation, or network interception—can extract the keys and decrypt the protected datasets without authentication or privilege escalation. The CVSS 3.1 score of 7.3 (HIGH) reflects the combination of network accessibility, low attack complexity, no privilege requirement, and resulting confidentiality and integrity impacts.

Business impact

Organizations deploying Securly for student/employee monitoring face compromise of their crisis intervention strategy and filter configuration. If crisis keywords and monitored site lists are exposed, threat actors could learn which behaviors or web domains trigger alerts, enabling evasion. Compromised site blocklists could be reverse-engineered to identify organizational security policies. Additionally, the incident undermines trust in the extension as a security tool and exposes the organization to regulatory or reputational risk if sensitive behavioral data becomes public. For Securly's reputation, this represents a fundamental security architecture failure that could accelerate customer churn.

Affected systems

Securly Chrome Extension version 3.0.7 is the confirmed affected release. Users of earlier or later versions should verify their build number against Securly's security advisory, as the vendor's patch timeline and backport strategy will determine the full scope of vulnerable installations in the wild.

Exploitability

Exploitation requires minimal resources. An attacker only needs to access the extension code, which is feasible through browser developer tools, extension extraction, or supply-chain interception. No user interaction, server compromise, or advanced reverse-engineering is required. The barrier to extracting the hardcoded keys and decrypting the protected data is very low, making this a practical vulnerability for determined adversaries. The absence of KEV designation does not reflect low exploitability—it reflects whether CISA has evidence of active in-the-wild exploitation, which may lag behind actual threat activity.

Remediation

Securly must immediately release a patched version that removes hardcoded keys from the extension code and transitions to a secure key derivation or key management approach—for example, deriving keys from user-specific or device-specific values, or fetching keys from a secure backend during extension initialization. Users should upgrade to the patched version as soon as it is available. Organizations should audit their deployed versions to identify systems still running 3.0.7 and enforce automatic or manual updates through Chrome policies or device management.

Patch guidance

Monitor Securly's official security advisory for the specific patch version number and release timeline. Once available, deploy the update through Chrome's auto-update mechanism or enforce it via organizational policies (e.g., ExtensionInstallForcelist or equivalent endpoint management controls). Verify that the patched version is installed across all user endpoints before considering the vulnerability remediated. Document the update deployment for compliance records.

Detection guidance

Network and endpoint teams should look for suspicious decryption activity or unauthorized access attempts to Securly extension files. Browser extension monitoring tools can flag modifications or unexpected access to securly.min.js. Additionally, organizations can audit installed extension versions via Chrome management consoles or endpoint detection and response (EDR) platforms to identify systems still on version 3.0.7. Log any extraction of extension code from user workstations, as this activity pattern may indicate adversary reconnaissance.

Why prioritize this

Although not yet on CISA's KEV list, this vulnerability warrants urgent prioritization due to its high CVSS score, trivial exploitability, and strategic value to adversaries seeking to understand or circumvent organizational monitoring policies. The hardcoding of credentials is a severe architectural flaw that requires immediate remediation. Any organization using Securly for security monitoring should treat this as a critical patch candidate.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects: (1) network accessibility with low attack complexity, (2) no authentication or user interaction required, (3) confidentiality impact through exposure of encrypted configuration data, (4) integrity impact if an attacker manipulates decrypted data before re-encryption or uses the plaintext keys to forge data, and (5) potential availability impact if the extension's core functionality is disrupted. The score appropriately elevates this beyond medium severity due to the combination of ease of exploitation and the sensitivity of the affected data.

Frequently asked questions