Is Web eID safe?

Question

Is Web eID safe?

Accepted Answer

Web eID is medium risk. Dynamic analysis confirmed that any JavaScript running on any webpage — including scripts injected by advertisements or exploited via cross-site scripting — can send a crafted window.postMessage to trigger the extension's eID authentication or signing operations. The content script checks only that the message came from the same window and starts with 'web-eid:', without verifying the origin of the sending page. During testing on example.com, a crafted postMessage caused the extension to acknowledge the request and initiate a call to the eu.webeid native application, confirming the relay operates without any origin restriction. Exploiting this requires code already running in the page context. Dynamic analysis confirmed that this extension registers a JavaScript class called window.TokenSigning on every website you visit, not just official eID portals. Any script on any page can call this API to request your eID signing certificate. The extension forwards the request to the eu.webeid native application, which presents a dialog prompting you to insert your physical card and enter your PIN. If you comply, the website receives your X.509 signing certificate containing your legal name and national identification number—with no restriction to trusted government or banking portals.

Is Web eID safe?

Findings