CVE-2026-8876: Securly Chrome Extension Info Disclosure

CVE-2026-8876 Overview

CVE-2026-8876 affects version 3.0.7 of the Securly Chrome Extension. The extension ships with hardcoded, plaintext Advanced Encryption Standard (AES) passphrases embedded in securly.min.js. These static keys decrypt crisis alert keyword data and intervention site data used by the extension. Any party that inspects the extension bundle can extract the keys and decrypt sensitive monitoring content. The vulnerability falls under the Hardcoded Credentials category and reflects a cryptographic key management failure. Public details are tracked in the CERT Vulnerability Report #595768.

Critical Impact

Plaintext AES passphrases in securly.min.js allow any reader of the extension to decrypt crisis alert keywords and intervention site data, exposing the monitoring logic protecting student users.

Affected Products

• Securly Chrome Extension version 3.0.7
• Components: securly.min.js
• Encrypted assets: crisis alert keyword data and intervention site data

Discovery Timeline

• 2026-06-03 - CVE-2026-8876 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-8876

Vulnerability Analysis

The Securly Chrome Extension uses AES encryption to protect two data sets bundled with or fetched by the extension: a list of crisis alert keywords and a list of intervention sites. The passphrases required to decrypt these data sets are written directly into securly.min.js as plaintext string literals. Because Chrome extensions are distributed as readable JavaScript, anyone who installs the extension can open the file and read the keys. An attacker who extracts the passphrases can decrypt the keyword lists and intervention domains, revealing the exact strings the extension watches for in student browsing activity. This knowledge lets an adversary craft browsing or messaging activity that evades monitoring or, conversely, triggers false alerts.

Root Cause

The root cause is the storage of long-lived symmetric cryptographic material inside client-side code [CWE-798: Use of Hard-coded Credentials]. Client-side JavaScript is not a confidentiality boundary, and bundling AES passphrases there reduces the encryption to obfuscation. Rotating the keys requires shipping a new extension build, and every prior version remains decryptable by anyone holding the extracted key.

Attack Vector

Exploitation requires no network access and no privileges. An attacker installs or downloads the Securly Chrome Extension, locates securly.min.js in the extension directory, and reads the AES passphrase string literals. The attacker then applies the passphrase to the encrypted keyword and intervention site blobs to recover their plaintext contents. From there, the attacker can enumerate every monitored term and site, then design evasion strategies or noise campaigns against the monitoring system.

No verified proof-of-concept code is published for this issue. See the CERT Vulnerability Report #595768 for additional technical context.

Detection Methods for CVE-2026-8876

Indicators of Compromise

• Presence of Securly Chrome Extension version 3.0.7 on managed endpoints, identifiable by extension manifest version metadata.
• Read or copy operations targeting securly.min.js from unexpected processes or user accounts.
• Outbound traffic patterns that consistently avoid the monitored keyword and domain set after key extraction.

Detection Strategies

• Inventory installed Chrome extensions across the fleet and flag any instance of Securly Chrome Extension at version 3.0.7.
• Hash securly.min.js from known-vulnerable builds and alert on its presence in enterprise endpoint inventories.
• Review browser extension change logs in mobile device management (MDM) and unified endpoint management (UEM) tools for deployments of the affected version.

Monitoring Recommendations

• Monitor file access to Chrome extension directories under user profile paths for reads by non-browser processes.
• Track Securly extension version rollouts and confirm endpoints move off 3.0.7 once a fixed build is available.
• Correlate sudden drops in crisis alert volume with extension version changes, which may indicate evasion using leaked keywords.

How to Mitigate CVE-2026-8876

Immediate Actions Required

• Identify every endpoint running Securly Chrome Extension 3.0.7 and prioritize upgrade to a vendor-supplied fixed version once released.
• Treat the embedded AES passphrases and any data they protect as public; do not rely on those keys for confidentiality going forward.
• Contact Securly support to confirm remediation status and obtain guidance on key rotation for affected deployments.

Patch Information

No fixed version is listed in the published advisory at the time of writing. Refer to the CERT Vulnerability Report #595768 and Securly vendor communications for the latest patch availability.

Workarounds

• Remove or disable Securly Chrome Extension 3.0.7 from managed Chrome profiles via enterprise policy until a fixed version is available.
• Pin extension deployment to a vendor-confirmed remediated build using the Chrome ExtensionInstallForcelist and ExtensionInstallAllowlist policies.
• Restrict end users from sideloading or downgrading the extension through Chrome enterprise policy.

# Example Chrome enterprise policy to block the affected extension by ID
# Replace EXTENSION_ID with the Securly Chrome Extension ID from the Chrome Web Store
cat <<'EOF' > /etc/opt/chrome/policies/managed/securly_block.json
{
  "ExtensionInstallBlocklist": ["EXTENSION_ID"],
  "ExtensionSettings": {
    "EXTENSION_ID": {
      "installation_mode": "blocked",
      "blocked_install_message": "Securly 3.0.7 blocked pending vendor fix for CVE-2026-8876."
    }
  }
}
EOF