The Securly Chrome Extension version 3.0.7 downloads config.json over an unencrypted HTTP connection and uses the new RegExp() constructor to compile server-provided patterns without checking for complexity. This lack of validation enables an attacker positioned on the network path to inject crafted regular expression patterns that trigger catastrophic backtracking, causing the extension to hang or crash and resulting in denial of service for users.

An attacker who can intercept and modify the HTTP traffic between the extension and the server can inject malicious regular expression patterns. These patterns cause the extension to perform excessive backtracking during regex evaluation, leading to denial of service that disrupts all browsing activities for the user. There is no indication of code execution or data leakage from the provided information.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/595768 for current remediation guidance. Until a fix is available, users should avoid using the vulnerable version or ensure the config.json is delivered over a secure channel (HTTPS) to prevent on-path tampering. Monitoring for updates from Securly is recommended.