PT-2026-46048 · Securly · Securly Chrome Extension

Santh · CVE-2026-8874 · Published 2026-06-03 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Securly Chrome Extension version 3.0.7

Description The extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP using the Fetch API. This represents an inconsistent implementation of Transport Layer Security (TLS), as other endpoints within the same extension correctly utilize HTTPS to fetch IWF and CIPA data.

Recommendations Update Securly Chrome Extension version 3.0.7 to a version that ensures all data is fetched over HTTPS.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2026-8874

Affected Products

Securly Chrome Extension

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-8874 · Security Note
• https://reddit.com/r/StopBadBots/comments/1twww49/insane_record_145_wordpress_plugins_exposed_with · Reddit Post
• https://kb.cert.org/vuls/id/595768 · Note
• https://reddit.com/r/SecOpsDaily/comments/1tvxfu7/vu595768_securly_chrome_extension_contains · Reddit Post
• https://t.me/cveNotify/213305 · Telegram Post
• https://t.me/CVEtracker/55754 · Telegram Post
• https://twitter.com/CVEnew/status/2062404846217781564 · Twitter Post