The vulnerability allows an attacker to use publicly accessible endpoints in the Securly Chrome Extension to retrieve SHA‑1 hash values that are only weakly obfuscated with a Caesar cipher. This obfuscation can be reversed with negligible effort, exposing original hash values and potentially revealing sensitive data such as password digests. The result is a loss of confidentiality and an increased risk of credential compromise.

The Securly Chrome Extension, specifically version 3.0.7, is impacted. Users installed with or using this version should review the extension’s presence in their browsers.

The exposed endpoints can be accessed without any authentication, suggesting an attack vector that merely requires network connectivity to the extension’s enabled services. The EPSS score of < 1% indicates a very low exploitation probability, and the CVSS score of 7.5 indicates moderate to high severity, while the vulnerability is not listed in the CISA KEV catalog. The nature of the flaw—unauthenticated access to hashed credentials—indicates a high risk to data confidentiality and integrity.