Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in denial of service on all browsing.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-06-04 | 1 | Disclosure1 |
| 2026-06-05 | 1 | General1 |
downloading config over HTTP and compiling server-supplied patterns straight into new RegExp() in a chrome extension on every kid's browser is not a vuln chain, that's a buffet. CVE-2026-8888 gets you in but the hardcoded AES keys in CVE-2026-8876 are the real headline.
Post summary
The text highlights CVE-2026-8888 and CVE-2026-8876, noting hardcoded AES keys as a headline, but offers no exploit details, patch references, or usage evidence.
CVE-2026-8888 Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() w… https://www.cve.org/CVERecord?id=CVE-2026-8888
Post summary
The tweet details a vulnerability in the Securly Chrome Extension that allows server-supplied RegExp patterns to be fetched over HTTP, but no PoC, exploit, or patch is mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | securly | securly | 3.0.7 | chrome | - |