Am I Being Pwned?
Get started

Is CFCA CryptoKit.YZW Extension safe?

Medium risk

CFCA CryptoKit.YZW Extension accepts a caller-supplied native messaging host name, allowing any whitelisted page to connect to any native application on the user's machine.

The extension acts as a bridge between web pages on a fixed set of Chinese financial domains (yzw.cn, cscec.com, paic.com.cn, cscec3b.com.cn, 3jyx.cn) and locally installed native applications via Chrome's native messaging API. When a page sends a connect request, the extension passes the page-supplied host name directly to chrome.runtime.connectNative() without validating it against any allowlist, and then forwards arbitrary message payloads verbatim to the connected host. Any page on the whitelisted domains can exploit this to reach any native messaging host registered on the user's system, not just the intended CFCA cryptographic application.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

developerv3.4.0.5Chrome Web Store
42Risk
Who publishes it

developer - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
developer

Same store account

1 other listing published from this account, 6k+ users between them, none of them carrying a finding.

CFCA CertEnrollment.YZW Extension6k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 3.4.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on yzw.cn

    https://*.yzw.cn/* and 1 more

  • Read and change your data on yzw.cn.qa

    http://*.yzw.cn.qa/* and 1 more

  • Read and change your data on yzwdev.cn

    http://*.yzwdev.cn/* and 1 more

  • Read and change your data on yzwqa.cn

    http://*.yzwqa.cn/* and 1 more

  • Read and change your data on cscec.com

    http://*.cscec.com/* and 1 more

  • Read and change your data on paic.com.cn

    http://*.paic.com.cn/* and 1 more

  • Read and change your data on cscec3b.com.cn

    http://*.cscec3b.com.cn/* and 1 more

  • Read and change your data on 3jyx.cn

    http://*.3jyx.cn/* and 1 more

  • Talk to a program installed on your computer, outside the browser's sandbox

    nativeMessaging

Updated 2 November 2026gmcdjblnokdfaicekifdgkpmakafenho