Home
» GitHub Advisories
» GHSA-58xm-2wvc-7p7f
Description
Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS.
Basic information
Type
unreviewed
Severity
high Advisory on GitHub
Open advisory ↗ Repository advisory
—
Source code
Not specified Published (advisory)
2026-06-03 21:30:31 UTC
Updated
2026-06-04 18:31:34 UTC
NVD published
2026-06-03
EPSS Score
Score
Percentile
0.01%
0.90%
CVSS Scores
Base score
Version
Severity
Vector
7.1
3.1
—
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Click to expand
Attack vector (AV:A)
Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N)
Service keeps running; no real outage angle.
CWEs
CWE id
Name
CWE-319
Cleartext Transmission of Sensitive Information
cvelogic
Threat Intelligence