CVE-2026-8889: Securly Chrome Extension Vulnerability

CVE-2026-8889 Overview

CVE-2026-8889 affects version 3.0.7 of the Securly Chrome Extension. The extension relies on the deprecated SHA-1 hashing algorithm for two safety-critical matching functions. SHA-1 protects 25,020 Internet Watch Foundation (IWF) Child Sexual Abuse Material (CSAM) URL hashes and 12,352 Children's Internet Protection Act (CIPA) blocklist hashes.

Critical Impact

Use of a broken hash algorithm in safety filtering allows collision-based bypass of CSAM and CIPA blocklists, undermining child-protection controls deployed in K-12 environments.

Affected Products

• Securly Chrome Extension version 3.0.7
• IWF CSAM URL matching component (25,020 SHA-1 hashes)
• CIPA blocklist matching component (12,352 SHA-1 hashes)

Discovery Timeline

• 2026-06-03 - CVE-2026-8889 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-8889

Vulnerability Analysis

The Securly Chrome Extension performs URL filtering by hashing target URLs and comparing results against precomputed blocklist hashes. Version 3.0.7 implements this matching using SHA-1, which the cryptographic community has deprecated for collision resistance since the 2017 SHAttered demonstration.

Because SHA-1 collisions are computationally feasible, an attacker can craft URLs that produce hash values matching benign entries or that evade matching against malicious entries entirely. The defect maps to [CWE-328] Use of Weak Hash and [CWE-327] Use of a Broken or Risky Cryptographic Algorithm.

The scale of affected matching is significant: 25,020 IWF CSAM URL hashes and 12,352 CIPA blocklist hashes rely on the weak primitive. Both lists protect minors on school-managed Chromebooks and similar devices.

Root Cause

The root cause is the selection of SHA-1 as the matching primitive within the extension's content-filtering pipeline. SHA-1 lacks the collision resistance required for adversarial input matching against curated blocklists.

Attack Vector

An attacker with the ability to publish or redirect to arbitrary URLs can construct collisions or near-collisions against the curated SHA-1 hash sets. The crafted URL evades CIPA filtering or misidentifies content category, defeating the extension's policy controls without requiring authentication to the management console.

No verified exploitation code is published. Refer to the CERT Vulnerability Advisory #595768 for coordinated disclosure details.

Detection Methods for CVE-2026-8889

Indicators of Compromise

• Browser telemetry showing access to known-malicious URLs despite an active Securly extension at version 3.0.7
• Unexpected URL patterns containing high-entropy path or query components designed to manipulate hash outputs
• Discrepancies between Securly category logs and upstream proxy or DNS filtering classifications for the same URL

Detection Strategies

• Inventory managed Chrome browsers for the Securly extension and flag any instance running version 3.0.7
• Correlate browser history with independent threat intelligence feeds to identify filter-evasion events
• Audit extension management policies in Google Admin Console for forced-installed versions matching the vulnerable build

Monitoring Recommendations

• Forward Chrome extension version inventory to the SIEM and alert on persistence of version 3.0.7 after the patch window
• Monitor outbound web traffic from student devices for URLs that bypass content categorization
• Track CERT advisory updates from CERT Vulnerability Advisory #595768 for revised affected version ranges

How to Mitigate CVE-2026-8889

Immediate Actions Required

• Identify all endpoints running Securly Chrome Extension version 3.0.7 through enterprise browser management
• Force-update the extension to a vendor-released version that replaces SHA-1 with a collision-resistant algorithm such as SHA-256
• Layer secondary URL filtering at the network egress to compensate while the extension is updated

Patch Information

No specific patched version is referenced in the NVD entry. Consult the CERT Vulnerability Advisory #595768 and the vendor for remediation guidance and a fixed release.

Workarounds

• Enforce DNS-layer filtering or secure web gateway policies that do not depend on the extension's hash matching
• Restrict student accounts to allowlisted domains where feasible, reducing exposure to collision-crafted URLs
• Disable or remove the vulnerable extension version through the Google Admin Console until a fixed build is deployed

# Example: list devices with the vulnerable extension version via Chrome Management API
gam report users parameters "accounts:browser_extensions" \
  | grep -i "securly" \
  | grep "3.0.7"