Executive brief
The Securly Chrome Extension, used by schools to filter internet content for students, contains a component that can cause a complete loss of web browsing capability. If the extension cannot reach its central servers, it may indefinitely hide all website content and pause videos, effectively preventing students from using their devices for educational purposes. Additionally, the extension uses a method to load code that bypasses standard security reviews, which could be abused to manipulate what users see on any website.
Technical details
The Securly Chrome Extension (v3.0.7) dynamically registers 'content13.min.js' as a content script at runtime using the chrome.scripting.registerContentScripts() API. Because this script is not declared in the extension's manifest.json, it bypasses the Chrome Web Store's static security review process. The script is designed to run on all URLs, immediately hiding page content and pausing videos until a service worker confirms the page has passed filtering. If the backend filtering servers are unreachable, the script fails to restore content, resulting in a persistent denial-of-service (DoS) for the user's browser. No patch is currently available as the vendor could not be reached.
Affected products
- Securly Securly Chrome Extension 3.0.7
Timeline
- 2026-03-30: other: Vendor notified by CERT/CC
- 2026-06-03: disclosed: Vulnerability disclosed by CERT/CC and NVD