The Securly Chrome Extension version 3.0.7 uses SHA-1, a deprecated cryptographic hash function, for matching URLs against IWF CSAM and CIPA blocklists. This use of SHA-1 (CWE-328) introduces a cryptographic weakness that could potentially be exploited to bypass or manipulate URL matching mechanisms. The vulnerability is documented as CVE-2026-8889. No CVSS score or vendor remediation details are currently available. The extension is not a cloud service, so remediation depends on the vendor releasing an update. No known exploits have been reported.

The impact stems from the use of SHA-1, which is vulnerable to collision attacks, potentially allowing an attacker to craft URLs that evade detection or blocking by the extension's filtering mechanisms. However, there is no evidence of active exploitation or direct compromise resulting from this vulnerability. The weakness could reduce the effectiveness of content filtering, which may have security and compliance implications.

Patch status is not yet confirmed — check the vendor advisory (https://kb.cert.org/vuls/id/595768) for current remediation guidance. Until a fix is available, users should be aware of the cryptographic weakness and consider limiting reliance on this extension for critical content filtering. No vendor advisory indicates that no action is required or that the issue is already mitigated.