CVE-2026-8879

Katalog CVE

CVSS 7.5 · High EPSS 0,51%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada securly. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. This script is NOT declared in manifest.json and bypasses Chrome Web Store static security review. It runs on all URLs and immediately hides all page content, creates a full-page overlay, pauses all videos, and only restores content when the service worker confirms the page passes filtering. If Securly's servers are unreachable, pages remain indefinitely hidden.

Rincian

Terbit di NVD

3 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://kb.cert.org/vuls/id/595768 advisory pihak ketiga