CVE-2026-8876: CVE-2026-8876

Synopsis

This is a hardcoded-credential / information-disclosure vulnerability in the Securly Chrome Extension version 3.0.7 and earlier. The extension bundles plaintext AES passphrases directly in its JavaScript file (securly.min.js), exposing the keys used to decrypt crisis alert keyword lists and intervention site data. Any attacker who obtains the extension package, which is reachable over the network without authentication, can extract those keys and decrypt the protected data. No fix version has been published; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available the moment one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The extension package is distributed over the network, so an attacker can retrieve and inspect it without any special network position.

• AuthenticationNot required

  No credentials or account of any kind are required to download the extension and extract the hardcoded passphrases from securly.min.js.

• Victim interactionNot required

  No user action is needed; the attacker operates entirely against the static extension artifact.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: the passphrases are present in plaintext and require only a text search or basic JavaScript inspection to locate.

Blast Radius

• Attacker reads the hardcoded AES passphrases from securly.min.js and decrypts the full crisis alert keyword list that the extension uses to flag student activity.
• Attacker decrypts the intervention site list, revealing the specific domains and URLs the extension is configured to block or monitor.
• Partial integrity impact: knowledge of the encryption keys and data structures opens the door to crafting inputs that bypass keyword or site-blocking logic (CVSS I:L).
• Partial availability impact: an attacker with this knowledge can interfere with the extension's alerting functions, potentially suppressing crisis notifications (CVSS A:L).