Executive brief
The Securly Chrome Extension, used by schools to manage student internet safety, contains a flaw that exposes sensitive filtering rules and data. An unauthorized person can access internal information like website blocklists and keyword lists because the extension uses weak security measures that are easily bypassed. This could allow someone to understand or circumvent the safety filters intended to protect students.
Technical details
The Securly Chrome Extension (v3.0.7) exposes multiple publicly accessible endpoints that do not require authentication. These endpoints provide access to sensitive data, including SHA-1 hashes of filtering rules and keywords. The hashes are obfuscated using a simple Caesar cipher, which is a trivial substitution cipher that can be easily reversed by an attacker. By reversing the obfuscation, an unauthenticated network attacker can recover the original hash values and access protected configuration data, such as internal keyword lists and blocklist definitions. As of the advisory date, the vendor has not released a patch.
Affected products
- Securly Securly Chrome Extension 3.0.7
Timeline
- 2026-03-30: other: Vendor notified
- 2026-06-03: disclosed: Public disclosure by CERT/CC