CVE-2026-8879: CVE-2026-8879

Synopsis

This is a denial-of-service vulnerability in the Securly Chrome Extension version 3.0.7 and earlier. The extension dynamically registers a content script (content13.min.js) at runtime without declaring it in the extension manifest, bypassing Chrome Web Store static review; the script hides all page content and blocks rendering until Securly's filtering servers respond. An attacker or network condition that makes those servers unreachable causes pages to remain permanently hidden, denying users access to all web content in the affected browser. No fix version is currently published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is reachable over the network; any browser running the affected extension that loses connectivity to Securly's filtering servers triggers the denial-of-service condition.

• AuthenticationNot required

  No authentication is required; the denial-of-service condition is triggered without any credentials or account access.

• Victim interactionNot required

  No victim interaction is required; the content script runs automatically on every page load without any user action.

• Attack complexityDetail

  Attack complexity is low; exploiting the condition requires no special timing, race conditions, or environmental setup beyond making Securly's servers unreachable.

Blast Radius

• All web page content in the affected browser is hidden and rendered inaccessible for the duration of the outage or server-unreachability condition.
• Videos and interactive content are paused and cannot be resumed until the filtering server responds.
• Users lose access to every URL visited in the browser, not just specific sites, because the script runs on all URLs.
• Persistent or repeated server unavailability causes a sustained, browser-wide denial of web access with no user-side recovery option.