CVE-2026-8888: Securly Chrome Extension DoS Vulnerability

CVE-2026-8888 Overview

CVE-2026-8888 affects version 3.0.7 of the Securly Chrome Extension. The extension downloads its config.json file over unencrypted HTTP and compiles server-supplied patterns into JavaScript regular expressions using new RegExp(). The extension performs no complexity validation on these patterns before compilation. An on-path attacker who intercepts the HTTP response can inject regex patterns crafted to trigger catastrophic backtracking. The resulting CPU exhaustion causes a denial of service across all browsing activity in the affected browser session.

Critical Impact

An on-path attacker can inject malicious regex patterns that cause catastrophic backtracking, exhausting CPU resources and denying browsing functionality to users of the Securly Chrome Extension version 3.0.7.

Affected Products

• Securly Chrome Extension version 3.0.7

Discovery Timeline

• 2026-06-03 - CVE-2026-8888 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-8888

Vulnerability Analysis

The vulnerability combines two distinct weaknesses into a single exploitable chain. First, the extension retrieves its config.json configuration file using HTTP rather than HTTPS. This exposes the configuration channel to network adversaries positioned between the browser and the configuration server. Second, the extension passes server-provided strings directly to the new RegExp() constructor without screening them for expensive patterns. The combined effect converts a network-layer integrity flaw into a client-side denial of service condition affecting all browsing.

Root Cause

The root cause is twofold. The extension relies on an insecure transport for security-relevant configuration data, violating standard practice for configuration retrieval. It also trusts remote pattern content implicitly. JavaScript regular expression engines use backtracking automata that can exhibit exponential time complexity against adversarially constructed patterns. Without complexity validation or execution timeouts, compiled regexes can monopolize the JavaScript thread during pattern matching against any input string.

Attack Vector

An attacker on the network path between the user and the configuration host intercepts the plaintext HTTP request for config.json. The attacker substitutes a response containing regex patterns designed to trigger catastrophic backtracking. Classic examples include nested quantifiers such as (a+)+$ evaluated against long non-matching inputs. When the extension applies the compiled pattern to URLs or page content during normal browsing, the regex engine enters exponential backtracking. The browser tab consumes 100% CPU and stalls, preventing further browsing activity until the process is terminated.

No verified exploit code is publicly available. See the CERT Vulnerability Advisory #595768 for additional technical context.

Detection Methods for CVE-2026-8888

Indicators of Compromise

• Outbound plaintext HTTP requests from Chrome to Securly configuration endpoints retrieving config.json.
• Sustained high CPU utilization in a Chrome renderer or extension service worker process coinciding with browsing activity.
• Unexpected modifications to extension-cached configuration data containing regex patterns with nested quantifiers.

Detection Strategies

• Monitor network traffic for HTTP requests to known Securly configuration hosts and flag responses that should be served over HTTPS.
• Inspect cached config.json content on managed endpoints for regex patterns containing nested or overlapping quantifiers such as (a+)+, (a|a)*, or (.*)*.
• Alert on Chrome renderer processes sustaining elevated CPU usage tied to specific extension IDs.

Monitoring Recommendations

• Log and review all extension update and configuration fetch traffic from corporate browser fleets.
• Track browser performance telemetry for anomalous tab freezes correlated with the Securly extension being active.
• Apply network inspection rules that detect HTTP retrieval of JSON configuration files from extensions, where HTTPS is expected.

How to Mitigate CVE-2026-8888

Immediate Actions Required

• Inventory managed Chrome browsers to identify installations of the Securly Chrome Extension version 3.0.7.
• Disable or remove version 3.0.7 of the extension until a fixed release is confirmed by the vendor.
• Block plaintext HTTP retrieval of config.json from the Securly configuration host at the network perimeter where feasible.

Patch Information

No vendor patch reference is included in the published CVE data. Administrators should consult the CERT Vulnerability Advisory #595768 for current vendor remediation status and upgrade guidance.

Workarounds

• Force configuration retrieval over HTTPS using network policy or proxy rewriting where supported.
• Restrict installation of the Securly Chrome Extension via enterprise browser policy until a remediated version is available.
• Use HSTS preloading and TLS-required egress policies to prevent downgrade of extension configuration traffic.