The Securly Chrome Extension version 3.0.7 retrieves a configuration file over an unsecured HTTP connection and uses the server‑supplied string to build JavaScript regular expressions through new RegExp() without limiting their complexity. An attacker who can manipulate the on‑path traffic can inject specially crafted patterns that trigger catastrophic backtracking. This leads to a denial of service by exhausting CPU resources for all browsing sessions that load the extension.

Securly Chrome Extension version 3.0.7 is affected. No other versions were identified.

The vulnerability is a client‑side denial of service that requires control over the HTTP stream to inject malicious regex expressions. Because the attack occurs on the user's browser, it is a local‑machine threat that can impact any user with the vulnerable extension installed. The CVSS score is not provided in the supplied data, and EPSS is not available; the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the possibility of triggering an application‑level outage makes it a medium‑to‑high risk until vendor mitigation is released.