Is Assinatura Digital no Navegador safe?

Question

Accepted Answer

Assinatura Digital no Navegador is medium risk. The extension manages ICP-Brasil digital signing certificates that embed your full legal name and Brazilian tax ID (CPF or CNPJ). While the extension requires your explicit permission before allowing a website to trigger a digital signature, the certificate listing function has no equivalent gate. Any website you visit while the extension is active can read the subjects of all signing certificates installed on your computer — including your legal name and tax ID — without showing a consent dialog. This was confirmed by dispatching the listing request from an unauthorized origin and observing the native PKI module respond immediately, with no authorization prompt appearing.

Is Assinatura Digital no Navegador safe?

Findings