The Securly Chrome Extension version 3.0.7 fetches certain JSON files containing sensitive filtering data over unencrypted HTTP using the Fetch API. This exposes the data to potential interception or tampering during transmission. Other data endpoints in the same extension use HTTPS properly, showing inconsistent application of transport layer security. The vulnerability is classified under CWE-319, which concerns cleartext transmission of sensitive information. No CVSS score or vendor patch information is currently available.

Sensitive data such as crisis alert keywords and filtering rules are transmitted without encryption, potentially allowing an attacker with network access to intercept or modify this information. This could undermine the integrity and confidentiality of the filtering mechanisms. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/595768 for current remediation guidance. Until a fix is available, users should be cautious about the security implications of this extension version. No official fix or workaround has been documented yet.