EUVD-2026-34166
GHSA-p539-q9q2-vqr2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (certcc) · only source for this CVE.
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. MD5 has been broken since 2004 and a single iteration provides no key stretching.
AnalysisAI
Cryptographic weakness in Securly Chrome Extension version 3.0.7 and earlier exposes AES-encrypted data to recovery attacks because the extension derives keys using EVP_BytesToKey with MD5 and only a single iteration. Remote attackers who can obtain ciphertext from the extension's storage or network exchanges can feasibly brute-force or precompute keys, leading to disclosure of protected information. EPSS is very low (0.01%), no public exploit has been identified, and the issue is not listed in CISA KEV.
Technical ContextAI
Securly is a school-focused content filtering and student safety platform whose Chrome Extension enforces policy and telemetry on managed Chromebooks and browsers. The vulnerable component uses OpenSSL's legacy EVP_BytesToKey password-based key derivation function with MD5 as the underlying hash and an iteration count of one, then feeds the derived key into AES. MD5 has been considered cryptographically broken since collision attacks were published in 2004, and a single hash iteration provides essentially no work-factor (key stretching) against offline dictionary or brute-force attacks. While no CWE is assigned in the input, this pattern aligns with CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-916 (Use of Password Hash With Insufficient Computational Effort). The CPE cpe:2.3:a:securly:securly_chrome_extension:*:*:*:*:*:*:*:* confirms the Securly-published extension as the affected product.
RemediationAI
No vendor-released patch identified at time of analysis; the CERT/CC note (https://kb.cert.org/vuls/id/595768) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-8881) should be monitored for a fixed Securly Chrome Extension version above 3.0.7, and administrators should update via the Chrome Web Store or their managed-extension policy as soon as Securly publishes a fixed build. Until a fix is released, administrators can reduce exposure by restricting deployment of the extension to environments where the encrypted data it handles is not considered sensitive, scoping the extension to managed profiles only, and rotating any credentials, tokens, or identifiers that may have been processed by the vulnerable build - note the trade-off that scoping or removing the extension will also disable Securly's filtering and safety telemetry. Network-layer controls (enforcing TLS to Securly endpoints, blocking interception proxies) reduce one ciphertext-acquisition path but do not address ciphertext stored locally in the browser profile.
More in Securly Chrome Extension
View allDenial of service in Securly Chrome Extension version 3.0.7 allows on-path network attackers to halt all browsing activi
Denial of service in Securly Chrome Extension 3.0.7 allows remote attackers to render all web browsing unusable when the
Information disclosure in Securly Chrome Extension version 3.0.7 allows remote unauthenticated attackers to retrieve SHA
Information disclosure weakness in Securly Chrome Extension version 3.0.7 stems from continued reliance on the deprecate
Hardcoded cryptographic secrets in Securly Chrome Extension version 3.0.7 allow remote attackers to decrypt sensitive cr
Cleartext transmission in Securly Chrome Extension version 3.0.7 exposes crisis alert keyword lists and content filterin
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today