CVE-2026-8888
Securly Chrome Extension Regex DoS via HTTP Config
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: CERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| securly | chrome_extension | 3.0.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Version 3.0.7 of the Securly Chrome Extension downloads a configuration file (config.json) over an unencrypted HTTP connection. It then compiles server-provided patterns into JavaScript regular expressions using new RegExp() without checking the complexity of these patterns.
Because of this, an attacker positioned on the network path (on-path attacker) can inject malicious patterns that cause catastrophic backtracking in the regular expressions, leading to a denial of service (DoS) affecting all browsing activities.
How can this vulnerability impact me? :
This vulnerability can cause a denial of service on all browsing by exploiting the way the extension processes regular expressions. An attacker who can intercept or modify the HTTP traffic can inject malicious patterns that cause the extension to hang or crash, disrupting normal browsing functionality.