EUVD-2026-34162
GHSA-ph4h-q38c-6xg4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (certcc) · only source for this CVE.
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data.
AnalysisAI
Hardcoded cryptographic secrets in Securly Chrome Extension version 3.0.7 allow remote attackers to decrypt sensitive crisis alert keyword lists and intervention site data shipped with the extension. The plaintext AES passphrases embedded in securly.min.js can be extracted by anyone who installs or inspects the extension, exposing the proprietary detection logic used to safeguard students. No public exploit has been identified at time of analysis, and EPSS rates exploitation probability at 0.02% (4th percentile), but the trivial extractability of the keys means any motivated actor can replicate the disclosure.
Technical ContextAI
Securly is a student-safety platform whose Chrome Extension is widely deployed in K-12 environments to monitor browsing and detect self-harm or violence indicators. The extension's client-side JavaScript bundle (securly.min.js) ships with AES symmetric passphrases stored as plaintext string literals, used to decrypt two assets distributed with the extension: the crisis keyword corpus and the intervention site list. This is the textbook 'Use of Hard-coded Cryptographic Key' weakness (CWE-321/CWE-798) - although the input lists CWE as N/A, the described pattern matches that class. Because Chrome extensions are unpacked client-side, any installer or browser DevTools user can read the bundle, defeating the obfuscation the encryption was intended to provide.
RemediationAI
No vendor-released patch identified at time of analysis - neither the input nor the CERT/CC reference cites a fixed Securly Chrome Extension build, so administrators should monitor https://kb.cert.org/vuls/id/595768 and the Chrome Web Store listing for an update past 3.0.7 and apply it via managed-extension policy as soon as available. As a compensating control, organizations that have already extracted the keyword corpus and rely on its secrecy should treat the keyword list as publicly known and supplement client-side detection with server-side or network-side analysis that does not depend on the extracted keys; this preserves coverage but increases backend processing cost. Disabling auto-update is not recommended because future fixes will arrive via that channel, but you can pin to a forthcoming fixed version once released. Direct affected users to Securly support to confirm a remediation timeline, and review any cached copies of the extension bundle within your environment to ensure they are not redistributed.
More in Securly Chrome Extension
View allDenial of service in Securly Chrome Extension version 3.0.7 allows on-path network attackers to halt all browsing activi
Denial of service in Securly Chrome Extension 3.0.7 allows remote attackers to render all web browsing unusable when the
Information disclosure in Securly Chrome Extension version 3.0.7 allows remote unauthenticated attackers to retrieve SHA
Information disclosure weakness in Securly Chrome Extension version 3.0.7 stems from continued reliance on the deprecate
Cryptographic weakness in Securly Chrome Extension version 3.0.7 and earlier exposes AES-encrypted data to recovery atta
Cleartext transmission in Securly Chrome Extension version 3.0.7 exposes crisis alert keyword lists and content filterin
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today