The Securly Chrome Extension version 3.0.7 contains hardcoded AES encryption keys in plaintext within its JavaScript code (securly.min.js). These keys decrypt sensitive information related to crisis alerts and intervention sites, which could allow an attacker with access to the extension code to decrypt protected data. The vulnerability is categorized under CWE-321 (Use of Hard-coded Cryptographic Key). No patch or official remediation level has been disclosed, and no exploits are currently known.

Exposure of hardcoded AES passphrases in the extension allows potential attackers or malicious actors with access to the extension code to decrypt sensitive data such as crisis alert keywords and intervention site information. This compromises the confidentiality of protected data handled by the extension. However, there are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable extension version to prevent exposure of sensitive data. Monitor the vendor advisory at https://kb.cert.org/vuls/id/595768 for updates.