The Securly Chrome Extension version 3.0.7 retrieves a configuration file over an unsecured HTTP connection and uses the server‑supplied string to build JavaScript regular expressions through new RegExp() without limiting their complexity. This vulnerability exploits weaknesses in regular expression handling (CWE-1333) and insufficient input validation (CWE-917). An attacker who can manipulate the on‑path traffic can inject specially crafted patterns that trigger catastrophic backtracking. This results in a denial of service by exhausting CPU resources for all browsing sessions that load the extension.

Securly Chrome Extension version 3.0.7 is affected. No other versions were identified.

The vulnerability is a client‑side denial of service that requires control over the HTTP stream to inject malicious regex expressions. Because the attack occurs on the user’s browser, it is a local‑machine threat that can impact any user with the vulnerable extension installed. The CVSS score of 7.5 and the EPSS score of <1% indicate a moderate severity with a very low exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the possibility of triggering an application‑level outage makes it a moderate‑to‑high risk until vendor mitigation is released.