CVE-2026-8888

CVE-2026-8888

Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in denial of service on all browsing.

Affected

Securly · Securly Chrome Extension

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.60% chance of exploitation in the next 30 days, 48th percentile

Published

2026-06-03

Updated

2026-06-04

Proof-of-concept exploits (1)

• George0Papasotiriou/CVE-2026-8888-Printer-Firmware-Unsigned-Update-via-HTTP0★ · 2026-08-03

Security advisories

• https://kb.cert.org/vuls/id/595768

References

• CVE Record
• NVD entry