CVE-2026-8879

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8879", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-05-18T20:29:18.234Z", "datePublished": "2026-06-03T18:11:04.269Z", "dateUpdated": "2026-06-04T14:13:20.892Z"}, "containers": {"cna": {"title": "CVE-2026-8879", "descriptions": [{"lang": "en", "value": "Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. This script is NOT declared in manifest.json and bypasses Chrome Web Store static security review. It runs on all URLs and immediately hides all page content, creates a full-page overlay, pauses all videos, and only restores content when the service worker confirms the page passes filtering. If Securly's servers are unreachable, pages remain indefinitely hidden."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Securly", "product": "Securly Chrome Extension", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "3.0.7", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/595768"}], "x_generator": {"engine": "VINCE 3.0.42", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-8879"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-06-03T18:11:04.269Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-829", "lang": "en", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T14:12:27.850403Z", "id": "CVE-2026-8879", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T14:13:20.892Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-8879", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T14:12:27.850403Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T14:11:51.736Z"}}], "cna": {"title": "CVE-2026-8879", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Securly", "product": "Securly Chrome Extension", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.0.7"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/595768"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.42", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-8879"}, "descriptions": [{"lang": "en", "value": "Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. This script is NOT declared in manifest.json and bypasses Chrome Web Store static security review. It runs on all URLs and immediately hides all page content, creates a full-page overlay, pauses all videos, and only restores content when the service worker confirms the page passes filtering. If Securly's servers are unreachable, pages remain indefinitely hidden."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-06-03T18:11:04.269Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8879", "state": "PUBLISHED", "dateUpdated": "2026-06-04T14:13:20.892Z", "dateReserved": "2026-05-18T20:29:18.234Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-06-03T18:11:04.269Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Securly Chrome Extension", "vendor": "Securly", "versions": [{"lessThanOrEqual": "3.0.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cret@cert.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:securly:securly:3.0.7:*:*:*:*:chrome:*:*", "matchCriteriaId": "CF6B029B-B152-4A34-AC5B-A417EB476C87", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. This script is NOT declared in manifest.json and bypasses Chrome Web Store static security review. It runs on all URLs and immediately hides all page content, creates a full-page overlay, pauses all videos, and only restores content when the service worker confirms the page passes filtering. If Securly's servers are unreachable, pages remain indefinitely hidden."}, {"lang": "es", "value": "Versi\u00f3n 3.0.7 de la Extensi\u00f3n de Chrome de Securly registra din\u00e1micamente content13.min.js como un script de contenido a trav\u00e9s de chrome.scripting.registerContentScripts() en tiempo de ejecuci\u00f3n. Este script NO est\u00e1 declarado en manifest.json y elude la revisi\u00f3n de seguridad est\u00e1tica de Chrome Web Store. Se ejecuta en todas las URL e inmediatamente oculta todo el contenido de la p\u00e1gina, crea una superposici\u00f3n de p\u00e1gina completa, pausa todos los videos y solo restaura el contenido cuando el service worker confirma que la p\u00e1gina pasa el filtrado. Si los servidores de Securly no son accesibles, las p\u00e1ginas permanecen ocultas indefinidamente."}], "id": "CVE-2026-8879", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8879", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-04T14:12:27.850403Z", "version": "2.0.3"}}]}, "published": "2026-06-03T19:16:39.513", "references": [{"source": "cret@cert.org", "tags": ["Third Party Advisory"], "url": "https://kb.cert.org/vuls/id/595768"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.0.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Securly Chrome Extension", "source": "cna", "vendor": "Securly"}, "product": "securly_chrome_extension", "vendor": "securly"}], "created": "2026-06-03T22:00:15.098072+00:00", "title": "Dynamically registered content scripts block web content in Securly Chrome Extension", "updated": "2026-06-05T10:11:25.034557+00:00", "vendors": ["securly", "securly$PRODUCT$securly_chrome_extension"], "weaknesses": ["CWE-269", "CWE-400", "CWE-829"]}