CVE-2026-8889: Securly Chrome Extension SHA-1 Hashing Vulnerability (CVSS 7.5)

Technical summary

CVE-2026-8889 identifies the use of deprecated SHA-1 hashing in Securly 3.0.7 for two distinct URL matching functions: IWF CSAM hash matching (25,020 hashes) and CIPA blocklist matching (12,352 hashes). SHA-1 is vulnerable to practical collision attacks, allowing an adversary to construct URLs that collide with existing hashes in these blocklists. The vulnerability maps to CWE-407 (Reliance on Untrusted Inputs in a Security Decision), as the hash collision could cause the extension to make incorrect filtering decisions. With a CVSS 3.1 score of 7.5 (high severity), the attack requires no authentication or user interaction and operates over the network, but confidentiality impact dominates the score rather than availability or integrity metrics.

Business impact

Organizations using Securly 3.0.7 for CIPA compliance or child safety may face regulatory exposure if the hash collision vulnerability allows prohibited content to reach end users. Schools and libraries relying on the extension for mandatory content filtering could face CIPA audit findings or legal liability if blocked material bypasses the filter due to a crafted URL. Reputational damage and loss of institutional trust are risks if the filtering failure is discovered or exploited.

Affected systems

The vulnerability affects Securly Chrome Extension version 3.0.7 specifically. Scope is limited to users running this version; patched or updated versions are not affected. Chrome browser deployments on Windows, macOS, and Linux are potentially vulnerable if version 3.0.7 is installed. Enterprise deployments via Chrome policies should verify their pinned or default extension versions.

Exploitability

Exploitability is moderate-to-high in a targeted scenario. An attacker must craft a URL whose SHA-1 hash collides with an existing entry in either the IWF CSAM or CIPA blocklist. While SHA-1 collision generation is computationally feasible (proven techniques exist in academic literature), it requires deliberate effort and is not a trivial on-the-fly operation. However, once a collision is generated, the bypass is deterministic and reliable. Active exploitation in the wild is not documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade Securly Chrome Extension to a version implementing cryptographically strong hashing (SHA-256 or SHA-3) for both IWF CSAM and CIPA blocklist matching. Verify the patched version in the Chrome Web Store or via Securly's official release notes. Organizations should prioritize deployment in test environments first, then roll out to production via managed Chrome policies to ensure uniform coverage.

Patch guidance

Check the Securly Chrome Web Store listing or official Securly advisory for the patched version number. If automatic updates are enabled, the extension should self-update to the remediated version. For managed deployments, administrators should verify the pinned extension version in Chrome policies and update it to the recommended patched release. Document the update in your change management system and test in a pilot group before full rollout. Securly's security advisory should specify the affected and remediated versions; cross-reference that guidance before deploying.

Detection guidance

Monitor Chrome extension versions in your environment using MDM/EMM tooling or Chrome extension reporting APIs. Flag any machines running Securly version 3.0.7 and prioritize them for patching. Review proxy logs or endpoint detection for anomalous unblocked content (though this is indirect). Securly administrators can query their deployment dashboards to identify affected clients. Consider adding a detection rule to your SIEM if Securly provides telemetry or logs that include extension version numbers.

Why prioritize this

HIGH priority. Although exploitation requires deliberate SHA-1 collision crafting and is not currently widespread, the impact on regulatory compliance (CIPA) and child safety make this a business-critical fix. Educational and public libraries using Securly for mandated filtering should remediate within 30 days. The high CVSS score, combined with the reputational and legal risks of a filtering bypass, justifies accelerated patching even in the absence of active exploit code.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible attack requiring no authentication or user interaction (AV:N/AC:L/PR:N/UI:N). The Confidentiality impact is High because successful URL hash collision could expose blocked (CSAM or age-inappropriate) content to users who should not see it. Integrity and Availability are marked as None because the extension does not become unstable or corrupt; the risk is information disclosure via bypass, not system compromise. The lack of Scope change (S:U) indicates the impact is limited to the confidentiality decision-making of the extension itself, not a broader system compromise.

Frequently asked questions