CVE-2026-8881: CVE-2026-8881

Synopsis

A weak cryptographic key derivation vulnerability exists in the Securly Chrome Extension versions 3.0.7 and earlier. The extension derives AES encryption keys using EVP_BytesToKey with MD5 and a single iteration, a combination that has been considered cryptographically broken since 2004 and provides no meaningful resistance to brute-force or preimage attacks. An unauthenticated attacker reachable over the network can exploit this weakness to recover encrypted data, resulting in full disclosure of confidential information protected by the extension. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the affected service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationNot required

  No credentials or session tokens are needed; PR:N means any unauthenticated party can attempt to exploit the weak key derivation.

• Victim interactionNot required

  The vulnerability is exploitable without any action from a user; UI:N confirms no social engineering or click is involved.

• Attack complexityDetail

  The exploit is reliable and condition-free; AC:L indicates no race conditions, special memory layout, or environmental dependencies must be satisfied.

Blast Radius

• An attacker recovers plaintext data that the extension encrypted under the weakly derived AES key, including any session material, credentials, or user activity records the extension was protecting.
• Confidentiality impact is rated HIGH (C:H), meaning the full scope of protected data is readable by the attacker, not just partial or sampled records.
• Integrity and availability are unaffected by this CVE; the attacker gains read access only and cannot modify or disrupt the extension's operation through this vector alone.