Vulnerability · Published Jun 3, 2026 · Assigned by certcc

CVE-2026-8888CVE-2026-8888

High 7.5

In plain English

A high-severity regular-expression denial of service in Securly Chrome Extension from Securly. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 62.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in denial of service on all browsing.

Affected products (as reported)

Vendor	Product	Versions
Securly	Securly Chrome Extension	0 – through 3.0.7

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://kb.cert.org/vuls/id/595768