CVE-2026-8889: CVE-2026-8889

Synopsis

This is a cryptographic weakness in the Securly Chrome Extension version 3.0.7 and earlier, where SHA-1 hashing is used for URL matching against CSAM and CIPA blocklists. The vulnerability is reachable over the network with no authentication required, as any network-accessible content or URL can interact with the affected matching logic. Successful exploitation allows an attacker to craft URLs that collide with or bypass the hash-based blocklist checks, exposing confidential hash data and defeating content filtering protections. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The affected URL-matching logic is exposed over the network, meaning an attacker must be able to deliver crafted URLs or content to the extension via standard network access.

• AuthenticationNot required

  No authentication is required; the extension processes URL matching without any credential check on the submitting party.

• Victim interactionNot required

  No victim interaction is needed; the extension processes URLs passively without requiring a user to take a deliberate action beyond normal browsing.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free once the attacker can supply a URL that produces a SHA-1 collision or prefix match against the blocklist hashes.

Blast Radius

• An attacker can craft URLs that produce SHA-1 collisions, bypassing CSAM URL matching across up to 25,020 hashes and CIPA blocklist matching across up to 12,352 hashes.
• Content filtering protections are defeated, allowing blocked URLs to be accessed as if they were never on the blocklist.
• The confidentiality impact is high: the weakness exposes the predictability and structure of the hash corpus, enabling enumeration or inference of blocked URL patterns.