Securly Chrome Extension Hardcoded AES Passphrases Vulnerability

A vulnerability exists in version 3.0.7 of the Securly Chrome Extension due to hardcoded, plaintext AES passphrases embedded in the file securly.min.js. These passphrases are used to decrypt crisis alert keyword data and intervention site data. This issue is part of a broader set of vulnerabilities in the extension, which is commonly used on K–12 school-managed Chromebooks.

Impact

The hardcoded AES passphrases can be exploited to decrypt sensitive crisis alert and intervention site data, potentially leading to unauthorized access or manipulation of this information.