CVE-2026-8874

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8874", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-05-18T20:26:19.787Z", "datePublished": "2026-06-03T18:03:04.592Z", "dateUpdated": "2026-06-04T14:43:00.488Z"}, "containers": {"cna": {"title": "CVE-2026-8874", "descriptions": [{"lang": "en", "value": "Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Securly", "product": "Securly Chrome Extension", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.7", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/595768"}], "x_generator": {"engine": "VINCE 3.0.42", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-8874"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-06-03T18:03:04.592Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-319", "lang": "en", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T14:42:14.501953Z", "id": "CVE-2026-8874", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T14:43:00.488Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-8874", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T14:42:14.501953Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T14:39:43.480Z"}}], "cna": {"title": "CVE-2026-8874", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Securly", "product": "Securly Chrome Extension", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.7", "versionType": "custom"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/595768"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.42", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-8874"}, "descriptions": [{"lang": "en", "value": "Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-06-03T18:03:04.592Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8874", "state": "PUBLISHED", "dateUpdated": "2026-06-04T14:43:00.488Z", "dateReserved": "2026-05-18T20:26:19.787Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-06-03T18:03:04.592Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Securly Chrome Extension", "vendor": "Securly", "versions": [{"lessThan": "3.0.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cret@cert.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:securly:securly:3.0.7:*:*:*:*:chrome:*:*", "matchCriteriaId": "CF6B029B-B152-4A34-AC5B-A417EB476C87", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS."}, {"lang": "es", "value": "La versi\u00f3n 3.0.7 de la extensi\u00f3n de Chrome de Securly descarga archivos JSON que contienen palabras clave de alerta de crisis y reglas de filtrado a trav\u00e9s de HTTP sin cifrar mediante la API Fetch. Otros puntos finales en la misma extensi\u00f3n recuperan correctamente los datos IWF y CIPA a trav\u00e9s de HTTPS, lo que demuestra una implementaci\u00f3n inconsistente de TLS."}], "id": "CVE-2026-8874", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8874", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-04T14:42:14.501953Z", "version": "2.0.3"}}]}, "published": "2026-06-03T19:16:39.090", "references": [{"source": "cret@cert.org", "tags": ["Third Party Advisory"], "url": "https://kb.cert.org/vuls/id/595768"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.0.7)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "chrome_extension", "vendor": "securly"}], "created": "2026-06-03T20:30:36.509429+00:00", "title": "Securly Chrome Extension Transmits Sensitive Data over Unencrypted HTTP", "updated": "2026-06-05T10:11:29.230524+00:00", "vendors": ["securly", "securly$PRODUCT$chrome_extension"]}