CVE-2026-8881
High · 7.5CVSS
7.5
EPSS
0.2%
Published
Jun 3, 2026
CISA due date
—
The record
Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. MD5 has been broken since 2004 and a single iteration provides no key stretching.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|