CVE-2026-8874
CVE-2026-8874
- State
- Published
- Severity
- 7.1 High
- Published
- Jun 3, 2026
- Updated
- Jun 4, 2026
- Reserved
- May 18, 2026
Description
Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.1 High | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-319 Cleartext Transmission of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
Securly Chrome ExtensionSecurly |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.