Belgium's eID signing extension handed any web page the card, the PIN and a drive-by RCE — an eIDAS Qualified Trust Service Provider's browser bridge that never checked the caller's origin

Connective is the browser extension plus native host that lets Belgian web services talk to the smart card in the reader — the national eID and Maestro payment cards — to authenticate users and produce eIDAS qualified electronic signatures, the tier that carries the same legal weight as a wet signature. Its vendor, Nitro Software Belgium, sits on the EU eIDAS Trusted List as a Qualified Trust Service Provider, the highest trust tier the regulation defines (Bay Area Labs, 2026-08-07). The researchers cite the vendor's own marketing for the deployment figures — "8 of the 10 largest banks in Belgium and 60+ Belgian government agencies and departments" — and say they independently confirmed the 2-million weekly-active-user count from the Chrome and Edge store listings; SecurityWeek, reporting the disclosure on 2026-08-10, put the affected population at roughly two million people (SecurityWeek, 2026-08-10).

The root defect is a missing trust boundary rather than a memory-safety bug: the extension forwards messages from web pages to the native host without telling the host which page sent them, so the component holding the card has no way to know who it is talking to (Bay Area Labs, 2026-08-07). The one gate that existed, an RSA-signed activationToken issued by partner sites, decodes to a UUID, a time-to-live and a feature bitmask — and carries no origin either, so any page can replay a token harvested from a legitimate site and reach every card command it enables. The researchers took theirs from a live Belgian service whose tokens allowed all operations with a 24-hour lifetime.

From there the second flaw hands over the secret the whole scheme rests on. When a user types their PIN into the native Connective dialog, the host returns a pinToken to the calling page — and the researchers found that token is a 48-byte blob containing both the ciphertext and the AES-128 key needed to decrypt it, alternating bytes of the first 32, with a hardcoded initialisation vector recovered from the binary; decrypting it yields the PIN digits plus an expiry (Bay Area Labs, 2026-08-07). Worse for the social-engineering step, the page controls the dialog's title and body text, so the prompt asking for the PIN can be made to read as an official identity confirmation while being driven by an advertisement in an invisible frame. With the PIN in hand the attacker can mint their own PIN tokens and keep using the card whenever it is in the reader. The researchers demonstrated an account takeover against a Belgian federal authentication portal on this path, and are explicit about what they did not test: they did not exercise the flow against the country's dominant identity app itself, and note there may be further steps involved.

The third flaw is the one the researchers call the most impactful. The reader-enumeration command accepts a library parameter naming a DLL to load, relative paths included, with the only constraint that the path contains .dll (Bay Area Labs, 2026-08-07). Because the browser blocks downloads with a bare .dll extension, they used a polyglot file whose name embeds the string inside an innocuous-looking document name, had the page download it automatically, and then walked a relative path from the extension's own directory under the user profile back into the downloads folder — arbitrary code execution at user privilege, out of the browser sandbox, from a page visit. They note there was nothing preventing it from spreading by stealing session material and messaging the link onward to other users of the same extension.

Remediation took 146 days from first report, and the interim state is the part worth studying: the first fix, on 2026-05-08, added a remote origin check, which the researchers point out meant only approved sites could still trigger the RCE or steal the PIN token; they told the vendor the same month that the library command was untouched and the PIN token was still reaching web pages. The complete fix landed on 2026-06-01 by disabling the library command and replacing the PIN token with a randomly generated identifier cached inside the extension, with the remote origin checks fully enforced from 2026-07-22 (Bay Area Labs, 2026-08-07). No CVE was assigned, and this run located no vendor advisory. The researchers also observe that the vendor advertises yearly penetration tests.

Triage: on an endpoint, the observable is a signing or smart-card native-messaging host process spawning or loading code that did not ship with it — in process-creation and image-load telemetry with parent lineage, a browser-installed helper under the user profile loading a library from a user-writable location such as the downloads directory, rather than from its own install path. Legitimate use of these bridges loads only the vendor's own modules and the platform smart-card libraries from fixed paths, so the discriminator is the load source, not the load itself.