CVE-2026-8876

Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data.

Score

CVSS 3.1 7.3 High

Status

Analyzed - cret@cert.org

Published

2026-06-03

Last modified

2026-06-04

Weaknesses

CWE-798

Affected products

• Securly (Securly)
• Securly Chrome Extension (Securly)

References

• https://kb.cert.org/vuls/id/595768