A security researcher has disclosed severe, now-fixed vulnerabilities in Connective, a digital identity browser extension used by more than two million people in Belgium. Developed by Nitro Software Belgium, the software underpins electronic identity authentication and legally binding digital signatures for eight of the country’s ten largest banks and over 60 government agencies.
James Arnott, founder of cybersecurity firm Bay Area Labs, found that the extension failed to verify which website was communicating with it. Because origin checks were missing, any website, including a malicious ad embedded in an otherwise legitimate page, could interact directly with the Connective application running on a victim’s machine without consent.
Silent Data Theft and Signature Forgery
According to Arnott, this allowed attackers to silently read connected electronic ID (eID) and payment card data. Worse, the software let web pages customize the text shown in authentication pop-ups without revealing the requesting domain, making it impossible for users to distinguish a legitimate prompt from a phishing attempt.
When a victim entered their PIN into one of these prompts, the application sent it back to the requesting webpage. Attackers could then use the stolen PIN to generate unauthorized approval tokens and forge legally binding electronic signatures whenever the victim’s physical eID card was inserted into a card reader.
Because government portals such as CSAM.be and third-party identity providers like Itsme rely on eID signatures for account registration and recovery, stolen signing capability could let attackers hijack or create digital identity accounts on those platforms, even though those services themselves contained no flaws.
Remote Code Execution and Worm Potential
Arnott also uncovered a separate remote code execution flaw that worked regardless of whether an eID card was plugged in. By exploiting how the application processed local files, a malicious website could force the software to execute attacker-controlled code at the user level. The attack chain required only that a victim download a disguised file and visit a webpage, a drive-by scenario that carried self-propagating, worm-like potential since it needed no special permissions and could hijack credentials to spread malicious links to further victims.
Remediation
Nitro fully resolved the issues 146 days after the initial report, deploying updates that block unauthorized origin requests and secure PIN handling, with final enforcement completed in late July. The researcher received a $200 bug bounty. No CVE identifiers have been assigned, and Nitro has not responded to requests for comment. Arnott disclosed the findings at DEF CON alongside a technical blog post.