CVE-2026-8888 — CVE-2026-8888
Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without co…
Published: 2026-06-03 · CVSS: 7.5 · CVSS 3.1
Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in denial of service on all browsing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7