CVE-2026-8889
Deprecated SHA-1 Hashing in Securly Chrome Extension
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: CERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| securly | chrome_extension | 3.0.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for matching URLs related to IWF CSAM (Child Sexual Abuse Material) and the CIPA blocklist.
Specifically, it uses SHA-1 hashes for 25,020 IWF CSAM URLs and 12,352 CIPA blocklist URLs, which is considered insecure because SHA-1 is a deprecated hashing algorithm vulnerable to collision attacks.
How can this vulnerability impact me? :
Using deprecated SHA-1 hashing can weaken the security of URL matching for harmful content filtering.
An attacker might exploit weaknesses in SHA-1 to bypass the filtering mechanisms, potentially allowing access to blocked or harmful URLs that should be restricted.