CVE-2026-8889 Details
Description
Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashes) and CIPA blocklist matching (12,352 hashes).
A vulnerability exists in version 3.0.7 of the Securly Chrome Extension, which is used on K–12 school-managed Chromebooks. The extension employs outdated SHA-1 hashing for matching URLs against the Internet Watch Foundation (IWF) Child Sexual Abuse Material (CSAM) database and the Children's Internet Protection Act (CIPA) blocklist. This vulnerability could potentially allow for the circumvention of content filtering rules, exposing students to inappropriate material or incorrectly blocking access to educational resources.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://kb.cert.org/vuls/id/595768 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| securly securly | 3.0.7 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | Initial Analysis | [email protected] |
| Jun 3, 2026 | New CVE Received | [email protected] |