Version 3.0.7 of the Securly Chrome Extension relies on SHA-1 hashing to match IWF CSAM URLs and CIPA blocklist entries. This weakness corresponds to CWE‑407, Weak Hash Function. SHA-1 is considered weak because collisions can be produced in reasonable time, which could allow an attacker to craft a hash that mimics a disallowed or blocked URL. The result would be the extension treating inappropriate content as allowed or wrongly blocking legitimate content, undermining its purpose of protecting children and other users. Based on the description, it is inferred that an attacker could potentially generate a collision that would bypass the extension’s filtering logic.

The Securly Chrome Extension, version 3.0.7, is affected. No other versions or related products were mentioned in the advisory.

The CVSS score is 7.5 and the EPSS score is < 1%, indicating that no publicly documented exploitation has yet been reported. The likely attack requires an attacker to produce a SHA-1 collision, a computationally intensive task that may not be practical in the short term. Nonetheless, the use of a broken hash algorithm compromises policy enforcement, and the absence of a KEV listing does not negate the potential impact.