CVE-2026-8874: CVE-2026-8874

Synopsis

This is a man-in-the-middle vulnerability affecting the Securly Chrome Extension versions prior to 3.0.7. The extension fetches JSON files containing crisis alert keywords and content-filtering rules over unencrypted HTTP, allowing an attacker on the same network segment to intercept and tamper with those downloads. Successful exploitation lets an attacker silently modify the keyword and filtering rule sets the extension relies on, suppressing alerts or bypassing content controls. A patched-image rebuild at version 3.0.7 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be present on the same adjacent network as the victim, such as a shared LAN, Wi-Fi segment, or VPN, to intercept the unencrypted HTTP fetch.

• AuthenticationNot required

  No credentials or account are needed; any unauthenticated party on the adjacent network can carry out the attack.

• Victim interactionNot required

  The extension fetches the JSON files automatically in the background, so no user action is required to trigger the vulnerable request.

• Attack complexityDetail

  Exploiting this requires only a standard HTTP interception or spoofing tool on the local network segment; no race conditions or special environmental conditions are needed.

Blast Radius

• An attacker reads the plaintext crisis alert keyword lists and content-filtering rules as they travel over the network, exposing the full rule configuration.
• An attacker modifies the downloaded JSON payload in transit, replacing or removing crisis keywords so that the extension fails to trigger alerts for at-risk users.
• An attacker injects arbitrary filtering rules, causing the extension to block or allow content categories that the deploying organization did not intend.