CVE-2026-8879: Securly Chrome Extension DoS Vulnerability

CVE-2026-8879 Overview

CVE-2026-8879 affects version 3.0.7 of the Securly Chrome Extension. The extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. Because this script is not declared in manifest.json, it bypasses Chrome Web Store static security review. The script runs on all URLs, immediately hides page content, creates a full-page overlay, and pauses all videos. Content is restored only when the service worker confirms the page passes filtering. If Securly's servers are unreachable, pages remain indefinitely hidden, creating a denial-of-service condition on user browsing activity.

Critical Impact

Server unreachability causes indefinite content hiding across all websites, and runtime script injection circumvents Chrome Web Store review controls.

Affected Products

• Securly Chrome Extension version 3.0.7

Discovery Timeline

• 2026-06-03 - CVE-2026-8879 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-8879

Vulnerability Analysis

The Securly Chrome Extension uses the chrome.scripting.registerContentScripts() API to register content13.min.js dynamically after installation. Content scripts declared in this manner are not subject to the static review process that examines manifest.json declarations during Chrome Web Store submission. The script targets all URLs without restriction.

Upon page load, the script applies CSS or DOM manipulation to hide all page content, injects a full-page overlay, and pauses video elements. The extension's service worker then evaluates the page against filtering rules hosted on Securly infrastructure. When the service worker returns an approval signal, the overlay is removed and content becomes visible.

The design assumes continuous connectivity to Securly's filtering servers. When those servers are unreachable, the approval signal never arrives, and the page remains hidden indefinitely. The combination of broad URL matching and a fail-closed default produces a denial-of-service condition tied to backend availability.

Root Cause

The root cause is the combination of two design choices. First, content script registration is deferred to runtime, bypassing static manifest review. Second, the page-visibility state defaults to hidden and depends on a positive remote response to transition to visible. There is no local fallback or timeout to restore content when the remote service is degraded.

Attack Vector

The attack vector is not a traditional adversarial exploit. Any disruption to Securly server reachability — outage, network filtering, DNS failure, or man-in-the-middle interference — triggers the impact. An attacker positioned to block traffic to Securly's filtering endpoints can render the user's browser unable to display any page. Refer to the CERT Vulnerability Advisory #595768 for additional technical context.

Detection Methods for CVE-2026-8879

Indicators of Compromise

• Presence of content13.min.js registered via chrome.scripting.registerContentScripts() rather than declared in manifest.json
• Persistent full-page overlays on all browser tabs after extension activation
• Service worker network requests to Securly filtering endpoints failing or timing out

Detection Strategies

• Enumerate installed Chrome extensions and inspect manifest contents against runtime-registered scripts using the chrome.scripting.getRegisteredContentScripts() API
• Compare declared content scripts in manifest.json against the live registration set to identify scripts injected outside static review
• Monitor browser telemetry for sustained DOM overlays and paused media elements across multiple unrelated domains

Monitoring Recommendations

• Audit endpoints for the Securly extension at version 3.0.7 and track update status
• Log outbound connectivity to Securly's filtering domains and alert on prolonged failures
• Review enterprise extension management policies to flag extensions that register scripts at runtime

How to Mitigate CVE-2026-8879

Immediate Actions Required

• Inventory affected endpoints running Securly Chrome Extension 3.0.7
• Ensure network paths to Securly's filtering service remain reachable to avoid the fail-closed condition
• Coordinate with Securly support for a patched extension version that addresses runtime script registration and fail-closed behavior

Patch Information

No vendor patch information is published in the available CVE data. Consult the CERT Vulnerability Advisory #595768 for vendor status updates.

Workarounds

• Remove or disable the Securly Chrome Extension version 3.0.7 where the filtering dependency is not required
• Use Chrome enterprise policy ExtensionInstallBlocklist to control deployment until a fixed version is released
• Validate that DNS resolution and outbound HTTPS to Securly endpoints succeed before deploying the extension at scale