The Securly Chrome Extension version 3.0.7 employs EVP_BytesToKey with MD5 hashing and a single iteration to derive keys for AES encryption. MD5 has been considered broken since 2004 due to vulnerabilities that allow collision attacks, and a single iteration provides no key stretching, making brute-force or precomputation attacks more feasible. This constitutes a CWE-916 weakness: use of password hash with insufficient computational effort, weakening the cryptographic strength of the extension's encryption mechanism.

The use of MD5 with a single iteration for key derivation weakens the cryptographic protection of data encrypted by the Securly Chrome Extension. This may allow attackers to more easily recover encryption keys or plaintext data if they obtain encrypted content, potentially compromising confidentiality. However, no known exploits are reported in the wild, and the exact impact depends on how the encryption keys and encrypted data are managed and protected within the extension.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/595768 for current remediation guidance. No official fix or vendor advisory indicating mitigation is currently available. Users should monitor the vendor advisory for updates and apply any future patches or updates that address this cryptographic weakness.