The Securly Chrome Extension version 3.0.7 employs EVP_BytesToKey with MD5 and a single iteration to derive keys for AES encryption. MD5 has been cryptographically broken since 2004, and using it with only one iteration fails to provide sufficient computational effort to protect the derived keys. This weakness in key derivation reduces the security of the encrypted data, potentially allowing attackers to recover encryption keys more easily than intended.

The vulnerability allows attackers to exploit weak key derivation in the Securly Chrome Extension, potentially compromising the confidentiality of encrypted data. The use of MD5 and a single iteration means the encryption keys can be derived with less computational effort, increasing the risk of key recovery and unauthorized data access. However, there is no indication of known exploits in the wild or impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/595768 for current remediation guidance. Until an official fix is available, users should consider avoiding use of version 3.0.7 or any versions confirmed to use this weak key derivation method. Monitor vendor communications for updates on patches or mitigations.