The Securly Chrome Extension version 3.0.7 contains an insecure storage vulnerability (CWE-922) where sensitive information is exposed through publicly accessible endpoints without authentication. The sensitive data exposed are SHA-1 hashes that are inadequately protected by a reversible Caesar cipher obfuscation. This weak protection allows attackers to easily reverse the cipher and retrieve the original hash values, potentially compromising the confidentiality of the protected data. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

An attacker can access sensitive data exposed by the extension without authentication by exploiting publicly accessible endpoints. The weak obfuscation of SHA-1 hashes using a simple Caesar cipher allows easy reversal to obtain the original hash values, leading to a high confidentiality impact. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is documented, users should avoid using version 3.0.7 of the Securly Chrome Extension until a patch is released. Monitoring the CERT advisory at https://kb.cert.org/vuls/id/595768 is recommended for updates. No vendor advisory states that no action is required or that the issue is mitigated.