Securly Chrome Extension Weak Encryption Vulnerability

A vulnerability exists in version 3.0.7 of the Securly Chrome Extension due to the use of EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. This implementation is flawed because MD5 has been compromised since 2004, and a single iteration lacks effective key stretching, significantly weakening the encryption's security. As a result, protected data is susceptible to efficient offline cracking.

Impact

Exploitation of this vulnerability undermines the encryption used to protect sensitive data, making it vulnerable to decryption and unauthorized access.