Am I Being Pwned?
Get started

Is CFCA CryptoKit.ChinaTRC_V3 Extension safe?

Low risk

CFCA CryptoKit relays a caller-named native messaging host and payload to it, with no allowlist check.

Pages on the extension's permitted intranet and *.chinatrc.com.cn origins can tell it which native messaging host to connect to and what to send, and the extension forwards that host name and payload to chrome.runtime.connectNative() without checking either against a fixed vendor host list. Many of those permitted origins are plaintext HTTP with no HTTPS counterpart, so the native-messaging bridge is reachable and driveable from unencrypted internal-network pages.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

zyyizhouv3.4.0.6Chrome Web Store
17Risk
Who publishes it

zyyizhou - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
zyyizhou

Same store account

1 other listing published from this account, 98 users between them, none of them carrying a finding.

CFCA CertEnrollment.ChinaTRC_V3 Extension98Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 3.4.0.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on 10.10.20.37

    http://10.10.20.37/* and 1 more

  • Read and change your data on 10.10.10.32

    http://10.10.10.32/* and 1 more

  • Read and change your data on 10.19.1.249

    http://10.19.1.249/* and 1 more

  • Read and change your data on 11.11.10.93

    http://11.11.10.93/*

  • Read and change your data on 11.12.3.25

    http://11.12.3.25/* and 1 more

  • Read and change your data on 11.12.2.17

    http://11.12.2.17/* and 1 more

  • Read and change your data on 11.12.5.27

    http://11.12.5.27/* and 1 more

  • Read and change your data on 11.12.2.44

    http://11.12.2.44/* and 1 more

  • Read and change your data on 10.19.1.250

    http://10.19.1.250/* and 1 more

  • Read and change your data on 10.19.1.251

    http://10.19.1.251/* and 1 more

  • Read and change your data on 10.19.1.252

    http://10.19.1.252/* and 1 more

  • Read and change your data on 11.12.50.18

    http://11.12.50.18/*

  • Read and change your data on 11.12.3.62

    http://11.12.3.62/*

  • Read and change your data on chinatrc.com.cn

    http://*.chinatrc.com.cn/* and 1 more

  • Read and change your data on 11.12.4.31

    http://11.12.4.31/*

  • Read and change your data on 11.12.4.53

    http://11.12.4.53/*

  • Read and change your data on 11.12.3.100

    http://11.12.3.100/*

  • Read and change your data on 11.12.3.101

    http://11.12.3.101/*

  • Read and change your data on 11.12.2.127

    http://11.12.2.127/*

  • Read and change your data on 11.12.2.128

    http://11.12.2.128/*

  • Read and change your data on 11.12.3.126

    http://11.12.3.126/*

  • Read and change your data on 11.12.3.61

    http://11.12.3.61/*

  • Read and change your data on 10.19.1.225

    http://10.19.1.225/* and 1 more

  • Read and change your data on 10.19.1.226

    http://10.19.1.226/* and 1 more

  • Read and change your data on 172.30.132.71

    http://172.30.132.71/*

  • Read and change your data on 172.31.132.71

    http://172.31.132.71/*

  • Read and change your data on 11.12.4.60

    http://11.12.4.60/*

  • Read and change your data on 11.12.3.113

    http://11.12.3.113/*

  • Read and change your data on 11.12.2.158

    http://11.12.2.158/*

  • Read and change your data on 11.12.7.53

    http://11.12.7.53/*

  • Talk to a program installed on your computer, outside the browser's sandbox

    nativeMessaging

Updated 30 September 2026lngfjbojbkopfphadiibodaeflhegdak