CVE-2026-8878: Securly Chrome Extension Info Disclosure

CVE-2026-8878 Overview

CVE-2026-8878 affects version 3.0.7 of the Securly Chrome Extension. The extension exposes multiple publicly accessible endpoints that allow unauthenticated access to sensitive data. The exposed data consists of SHA-1 hashes obfuscated using a simple Caesar cipher. Attackers can trivially reverse the cipher to recover the original hash values and access protected information.

The issue combines two weaknesses: missing authentication on sensitive endpoints and reliance on an obfuscation scheme that does not constitute encryption. Together, these flaws allow remote, unauthenticated retrieval and decoding of data the extension was intended to protect.

Critical Impact

Unauthenticated remote attackers can retrieve and reverse obfuscated SHA-1 hashes from public endpoints, exposing data the Securly Chrome Extension was designed to protect.

Affected Products

• Securly Chrome Extension version 3.0.7

Discovery Timeline

• 2026-06-03 - CVE-2026-8878 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-8878

Vulnerability Analysis

The Securly Chrome Extension exposes endpoints that return sensitive data without requiring authentication. Any client that knows or discovers the endpoint URL can request the data directly. This represents a broken access control condition combined with an information disclosure flaw.

The returned data is not transmitted in cleartext, but the protection applied is cosmetic. The extension obfuscates SHA-1 hashes with a Caesar cipher, a substitution scheme that shifts characters by a fixed offset. Caesar ciphers offer no cryptographic strength and can be reversed by iterating through the limited number of possible shifts.

Once reversed, the SHA-1 hashes become usable identifiers or lookup keys for the data the extension protects. An attacker who collects these hashes can correlate them against known datasets or use them to pivot into further access.

Root Cause

The root cause is twofold. First, the extension's backend endpoints lack authentication controls, allowing any unauthenticated client to query them. Second, the developer chose a Caesar cipher rather than an authenticated encryption scheme, treating obfuscation as a security boundary.

Attack Vector

An attacker identifies the exposed endpoints used by the Securly Chrome Extension version 3.0.7. The attacker issues unauthenticated HTTP requests to retrieve the obfuscated payloads. The attacker then applies the inverse Caesar shift to recover the underlying SHA-1 hash values and access the associated protected data.

No verified code examples are available. See the CERT Vulnerability Advisory #595768 for additional technical detail.

Detection Methods for CVE-2026-8878

Indicators of Compromise

• Repeated unauthenticated requests to Securly Chrome Extension backend endpoints from non-managed clients.
• Outbound traffic from endpoints running Securly Chrome Extension 3.0.7 that returns base64 or shifted-ASCII payloads consistent with Caesar-obfuscated SHA-1 strings.

Detection Strategies

• Inspect web proxy logs for direct requests to Securly Chrome Extension API endpoints that bypass the extension's normal browser-driven flow.
• Alert on user-agent or referer values that do not match expected Chrome extension request patterns when targeting Securly endpoints.

Monitoring Recommendations

• Monitor browser extension inventory for the presence of Securly Chrome Extension version 3.0.7 across managed endpoints.
• Track network calls from extension processes and correlate against expected Securly traffic baselines to surface anomalous bulk retrieval.

How to Mitigate CVE-2026-8878

Immediate Actions Required

• Inventory all managed Chrome browsers for the Securly extension and identify hosts running version 3.0.7.
• Restrict outbound access from end-user browsers to only required Securly endpoints until a vendor-supplied fix is confirmed.
• Review the CERT Vulnerability Advisory #595768 for vendor coordination status and any released remediation guidance.

Patch Information

No patched version is listed in the available CVE data. Consult the CERT Vulnerability Advisory #595768 and the Securly vendor for upgrade availability beyond version 3.0.7.

Workarounds

• Block or restrict access to the exposed Securly endpoints at the network egress layer where business operations allow.
• Use Chrome enterprise policies to manage the extension lifecycle and roll back or remove version 3.0.7 if a fixed release is unavailable.
• Treat any SHA-1 hashes or identifiers that may have been exposed through the endpoints as compromised and rotate associated secrets where applicable.