The vulnerability allows the Securly Chrome Extension to download JSON files containing crisis alert keywords and filtering rules over cleartext HTTP, exposing sensitive security information. Because the extension fetches this data via the Fetch API without encryption, an attacker able to intercept network traffic could read or modify these files. This leads to potential data exposure and manipulation of filtering behavior, undermining the integrity of the extension’s content filtering mechanisms.

The affected product is the Securly Chrome Extension, version 3.0.7. The vendor Securly released an extension for Chrome that was found to use unencrypted HTTP for certain data requests in that version.

The CVSS score is 7.1 and the EPSS score is <1%, indicating that exploitation is unlikely but possible. The vulnerability is not listed in CISA KEV. The likely attack vector is eavesdropping on the user’s network traffic; by intercepting the cleartext HTTP request, an attacker could read or tamper with the JSON files. Because the data contains crisis alert keywords and filtering rules, the attacker gains information that could help craft attacks or change filtering behavior, but no remote code execution is possible. Overall, the risk is moderate to high for environments that rely on the Securly Chrome Extension for filtering content.