Version 3.0.7 of the Securly Chrome Extension performs AES encryption by deriving keys with the EVP_BytesToKey algorithm, which uses MD5 and a single iteration. MD5 is a broken cryptographic hash, and a single iteration offers no key stretching, resulting in a very weak key derivation function. Based on the description, it is inferred that an attacker who obtains the derived key or related parameters may potentially recover the plaintext or impersonate the user, but the description does not confirm this is feasible or that an attack exploit exists.

The vulnerability is specific to the Securly Chrome Extension, version 3.0.7. No additional products or later versions are indicated as affected.

The CVSS score is 7.5, EPSS <1%, and it is not listed in the CISA KEV catalog, indicating a moderate quantitative risk. Based on the description, it is inferred that if an attacker can access the extension’s encrypted data, they may be able to derive the key. The lack of explicit attack vector in the data prevents precise modeling, but the presence of the extension on a device is the prerequisite for exploitation. Even with the low EPSS, the severity suggests the problem should be addressed promptly.