## Summary
Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys can decrypt crisis alert keyword data and intervention site data, exposing sensitive filtering/alerting information.
## Technical Details
- Root issue: hardcoded cryptographic material in securly.min.js (plaintext AES passphrases).
- Affected data: crisis alert keyword data and intervention site data.
- The CERT advisory also notes additional related weaknesses in the same extension version, including:
- Insecure transport: crisis alert keywords and filtering rules downloaded over unencrypted HTTP via the Fetch API (CVE-2026-8874).
- Improper access control: publicly accessible endpoints enabling unauthenticated access to sensitive data (CVE-2026-8878).
- Dynamic content script registration at runtime without manifest declaration (CVE-2026-8879).
## Affected
- securly / Securly Chrome Extension 3.0.7
## Impact
- Confidentiality impact: decrypted access to crisis alert keyword data and intervention site data.
- The advisory further indicates attackers may steal configuration information and potentially modify content blocking rules for student users (context for the broader 3.0.7 vulnerability set).
## Mitigation
1. Upgrade the Securly Chrome Extension to a version that removes hardcoded plaintext AES passphrases from securly.min.js.
2. Replace client-side encryption key material with a server-side key management approach (so keys are not recoverable from the extension bundle).
3. Review and remediate the related issues in 3.0.7 called out by CERT (CVE-2026-8874, CVE-2026-8878, CVE-2026-8879) to reduce exposure of sensitive data and access-control bypasses.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-798