CVE-2026-8888: Securly Chrome Extension HTTP Regex DoS Vulnerability

Technical summary

CVE-2026-8888 involves insecure transport and unsafe regex compilation in Securly 3.0.7. The extension retrieves config.json over unencrypted HTTP, creating a window for man-in-the-middle injection. Server-provided regex patterns are compiled directly using the new RegExp() constructor without complexity analysis or safeguards against catastrophic backtracking. Adversaries can craft patterns exhibiting exponential time complexity on certain inputs, causing the JavaScript engine to consume CPU and block the browser event loop, effectively denying service across all browsing sessions until the extension is disabled or the browser restarted.

Business impact

For organizations deploying Securly as a security appliance, this vulnerability creates a denial-of-service risk that bypasses the protective intent of the tool. An attacker with network-level access can render employee browsers unusable, disrupting productivity and potentially forcing workarounds that weaken security posture. The attack surface includes shared Wi-Fi networks, compromised ISPs, or internal network segments if an attacker gains foothold. The HIGH severity rating reflects the ease of exploitation and broad impact, though active exploitation in the wild is not currently tracked.

Affected systems

Securly Chrome Extension version 3.0.7 is the confirmed affected version. Organizations using this version across their endpoint fleet are at risk. Users on version 3.0.6 or earlier, or versions after the patch (verify against Securly's security advisory for the fixed version number), are not vulnerable to this specific chain. Chrome browser users on Windows, macOS, and Linux are affected if running the vulnerable extension version.

Exploitability

Exploitability is high because: (1) HTTP config delivery means no man-in-the-middle authentication is required; (2) regex compilation is automatic and unauthenticated; (3) the attack requires only network-level positioning, achievable in many real-world scenarios; (4) no user interaction is needed. The primary barrier is presence on the network path, which limits opportunistic attacks but is realistic for targeted campaigns, ISP-level threats, or internal network compromise. The CVSS:3.1/AV:N/AC:L vector confirms network accessibility with low attack complexity.

Remediation

Immediate action: upgrade Securly to the patched version (consult Securly's advisory for the correct build number). Interim mitigation: enforce HTTPS inspection policies to detect and block unencrypted config downloads, or temporarily disable the extension pending patching. Longer term: audit other browser extensions in your environment for similar insecure HTTP usage and unsafe deserialization patterns.

Patch guidance

Contact Securly directly or visit their Chrome Web Store listing for the latest version. Verify the extension auto-updates or manually check Manage Extensions (chrome://extensions) to confirm the installed version. Organizations using managed Chrome policies should prioritize pushing the patched version through their deployment mechanism. Test the patch in a sandbox or limited pilot before broad rollout to confirm no regression in content filtering or reporting functionality.

Detection guidance

Monitor for: (1) network traffic from Chrome clients initiating HTTP connections to Securly config endpoints (DNS queries for config domains); (2) browser hang or CPU spike events correlating with Securly extension activity, especially if reproducible; (3) user reports of browser freezes that resolve after disabling Securly or restarting the browser. Endpoint telemetry tools can flag processes in a hung state with high CPU. Check for Securly version via Chrome policy reporting or browser inventory tools. Regex-triggered CPU exhaustion may appear as a browser process consuming 100% of a single CPU core for extended periods.

Why prioritize this

HIGH CVSS (7.5) score, combined with low attack complexity and network accessibility, places this in the upper priority tier. While not yet in active exploitation tracking (KEV status: false), the combination of trivial network positioning requirements and high user impact makes this attractive to threat actors. Organizations with Securly deployed at scale should patch within days, not weeks. Critical for environments with open or partially trusted networks where MITM risk is elevated.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: Attack Vector Network (AV:N) — exploitable remotely without physical access; Attack Complexity Low (AC:L) — no special preconditions or race conditions; Privileges Required None (PR:N) — unauthenticated; User Interaction None (UI:N) — attack succeeds without user action; Scope Unchanged (S:U) — impact limited to the vulnerable component; Availability Impact High (A:H) — complete browser availability loss. Confidentiality and Integrity are Not affected (C:N/I:N) because the attack is purely denial-of-service, not data theft or modification.

Frequently asked questions