The Securly Chrome Extension version 3.0.7 suffers from CWE-922: Insecure Storage of Sensitive Information. It exposes multiple endpoints that do not require authentication, allowing any user to retrieve sensitive data. The data is protected only by SHA-1 hashes that are further obfuscated with a simple Caesar cipher. This weak obfuscation can be reversed easily, exposing the original hashes and potentially the underlying sensitive information. The vulnerability was published on 2026-06-03, but no CVSS score or vendor remediation details are available. The CERT advisory is the primary source of information.

The vulnerability allows unauthenticated attackers to access sensitive information stored by the extension by reversing weak obfuscation on SHA-1 hashes. This exposure could lead to unauthorized disclosure of protected data. However, no known exploits have been reported in the wild, and the exact nature of the sensitive data is not detailed in the available information.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/595768 for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected extension version to prevent exposure. No vendor advisory indicates that the issue is already mitigated or requires no action.