A browser extension that lets Belgian bank and government websites talk to eID smart card readers accepted instructions from any website that asked, according to independent researcher James Arnott, who published his findings on 7 August and presented them at DEF CON 34.
The extension is the Connective Signing Extension, from Nitro Software Belgium. Arnott says it is used by eight of Belgium's ten largest banks and more than 60 government agencies and departments, and that it underpins qualified electronic signatures under the European Union's eIDAS regulation. Its Chrome listing reports over two million users. Those figures are his own: the vendor has published no advisory, and we found none from Belgium's national cyber authority either.
Three problems, one architecture
An extension like this exists to bridge a web page to a program running on your computer, in this case one that speaks to the card reader. That bridge is the whole risk, and Arnott describes three ways it failed.
First, the tokens authorising a page to talk to the extension were not tied to the site that requested them. Any website, or any advert loaded in a frame on a legitimate one, could read data from an inserted card without the user agreeing to anything. The token protecting the card's PIN was handed back to the page together with the key needed to decrypt it, and with a fixed initialisation value, so the PIN itself could be recovered.
Second, the page controlled the wording of the PIN prompt, including its title and its message. A consent dialog an attacker can write is a phishing tool rather than a safeguard.
Third, one command let the page specify a relative path for a library the local program should load, so a website could make it load a file the attacker supplied. Arnott demonstrates this as a drive-by: the visitor sees what looks like an ordinary file download, and the attacker gets code execution on the machine.
Already fixed, with caveats
This is patched. Arnott's timeline runs to about 146 days: a partial fix on 8 May 2026, a complete patch on 1 June, and enforcement of checks on which site is calling from 22 July. He says publication was approved under Belgium's national safe harbour policy for vulnerability disclosure, and that the bounty offered was 200 dollars.
Two things temper the story. No CVE was assigned, so there is nothing for vulnerability scanners or trackers to key on. And no version numbers were published, so users cannot tell a vulnerable build from a fixed one, which leaves the practical advice at simply confirming the extension has updated. There is no evidence that anyone exploited this before the fix landed.
Proof-of-concept code is public, covering a silent card read, an account takeover driven from a malicious advert frame, and the code execution path. That raises the stakes for anyone still running an old build, and it is why the architectural lesson matters more than the individual bugs. A browser extension that connects untrusted web content to a privileged local program which will load arbitrary libraries is a design that fails badly the moment any single check is missed, and the checks here were missing for years rather than days.
Arnott's writeup is at Am I Being Pwned. The shape resembles an attack we covered where a phishing campaign abused a browser extension's link to a local program to hijack sessions, and hardware-backed identity is no guarantee on its own, as malware capable of stealing Google passkeys showed. More on Belgium is on our country profile.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.