CVE-2026-8889 CVE-2026-8889

High 7.5 Published 3 Jun 2026 Updated 10 Jun 2026

The extension uses deprecated SHA-1 hashing for URL blocklists, potentially allowing attackers to bypass content filtering protections.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-8889?

CVE-2026-8889 is a high-severity vulnerability in Securly Chrome Extension, published on 3 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashes) and CIPA blocklist matching (12,352 hashes).

Weakness: CWE-407

Which versions are affected by CVE-2026-8889?

It affects 1 product.

Products include Securly Securly.

How do I fix CVE-2026-8889?

No fix has been published for CVE-2026-8889 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-8889 being exploited?

There is no known exploitation of CVE-2026-8889 in the wild and no public exploit code.

Sources

Also known as GHSA-7qqf-r2pg-xhqj.