Am I Being Pwned?
Get started

Is CFCA CertEnrollment.ChinaTRC_V3 Extension safe?

Low risk

CFCA CertEnrollment relays messages from a narrow set of internal addresses to a local PKI app without validating the command.

The extension listens for external messages and forwards a caller-supplied native-messaging host name and payload straight through to a local native application, with no schema or command checks once the message arrives. Only around 40 origins can reach it, almost all private internal network addresses (10.x/11.x/172.x) plus one CFCA-owned wildcard domain, so exposure is limited to that specific corporate network rather than the open web.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

zyyizhouv3.2.0.7Chrome Web Store
17Risk
Who publishes it

zyyizhou - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
zyyizhou

Same store account

1 other listing published from this account, 98 users between them, none of them carrying a finding.

CFCA CryptoKit.ChinaTRC_V3 Extension98Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 3.2.0.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on 10.10.20.37

    http://10.10.20.37/* and 1 more

  • Read and change your data on 10.10.10.32

    http://10.10.10.32/* and 1 more

  • Read and change your data on 10.19.1.249

    http://10.19.1.249/* and 1 more

  • Read and change your data on 11.11.10.93

    http://11.11.10.93/*

  • Read and change your data on 11.12.3.25

    http://11.12.3.25/* and 1 more

  • Read and change your data on 11.12.2.17

    http://11.12.2.17/* and 1 more

  • Read and change your data on 11.12.5.27

    http://11.12.5.27/* and 1 more

  • Read and change your data on 11.12.2.44

    http://11.12.2.44/* and 1 more

  • Read and change your data on 10.19.1.250

    http://10.19.1.250/* and 1 more

  • Read and change your data on 10.19.1.251

    http://10.19.1.251/* and 1 more

  • Read and change your data on 10.19.1.252

    http://10.19.1.252/* and 1 more

  • Read and change your data on 11.12.50.18

    http://11.12.50.18/*

  • Read and change your data on 11.12.3.62

    http://11.12.3.62/*

  • Read and change your data on chinatrc.com.cn

    http://*.chinatrc.com.cn/* and 1 more

  • Read and change your data on 11.12.4.31

    http://11.12.4.31/*

  • Read and change your data on 11.12.4.53

    http://11.12.4.53/*

  • Read and change your data on 11.12.3.100

    http://11.12.3.100/*

  • Read and change your data on 11.12.3.101

    http://11.12.3.101/*

  • Read and change your data on 11.12.2.127

    http://11.12.2.127/*

  • Read and change your data on 11.12.2.128

    http://11.12.2.128/*

  • Read and change your data on 11.12.3.126

    http://11.12.3.126/*

  • Read and change your data on 11.12.3.61

    http://11.12.3.61/*

  • Read and change your data on 10.19.1.225

    http://10.19.1.225/* and 1 more

  • Read and change your data on 10.19.1.226

    http://10.19.1.226/* and 1 more

  • Read and change your data on 172.30.132.71

    http://172.30.132.71/*

  • Read and change your data on 172.31.132.71

    http://172.31.132.71/*

  • Read and change your data on 11.12.4.60

    http://11.12.4.60/*

  • Read and change your data on 11.12.3.113

    http://11.12.3.113/*

  • Read and change your data on 11.12.2.158

    http://11.12.2.158/*

  • Read and change your data on 11.12.7.53

    http://11.12.7.53/*

  • Talk to a program installed on your computer, outside the browser's sandbox

    nativeMessaging

Where it sends data

Destinations our analysis observed CFCA CertEnrollment.ChinaTRC_V3 Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • local native-messaging host (PKI/certificate application)

    CFCA CertEnrollment.ChinaTRC_V3 Extension sends data to local native-messaging host (PKI/certificate application). Named as a recipient in this extension's own analysis.

Updated 30 September 2026ldlimjohgodlchaagdhiljpccoohejbk