The Securly Chrome Extension version 3.0.7 embeds hardcoded AES encryption keys in plaintext within its JavaScript code (securly.min.js). These keys are used to decrypt sensitive information related to crisis alert keywords and intervention site data. The presence of hardcoded cryptographic keys violates secure coding practices (CWE-321) and can allow attackers who access the extension code to decrypt protected data, potentially compromising confidentiality and integrity. No official patch or remediation level has been provided by the vendor or CERT advisory at this time.

An attacker who obtains the extension code can extract the hardcoded AES keys and decrypt sensitive data such as crisis alert keywords and intervention site information. This compromises the confidentiality and integrity of this data. The vulnerability has a high CVSS score (7.3) reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or remediation level has been published by the vendor or CERT advisory. Until a patch is available, users should consider disabling or uninstalling version 3.0.7 of the Securly Chrome Extension to avoid exposure to this vulnerability.