Summary
- Researchers found that Connective's browser-to-native interface did not adequately bind privileged requests to the web origin making them.
- The software has more than two million weekly users and has been marketed as serving major Belgian banks, government bodies, and enterprises.
- Nitro deployed fixes in stages between May and July; the disclosure demonstrates proof-of-concept exploitation but does not establish malicious in-the-wild abuse.
Security flaws in software connecting Belgian electronic identity cards to online services allowed researchers to access card information, interfere with PIN handling, and execute code on users’ computers, exposing weaknesses inside a digital-trust chain used across banking, government, and enterprise services.
The affected Connective signing software is operated by Nitro following its acquisition of the Belgian electronic-signature provider. It uses a browser extension and a native application to connect websites with electronic identity and payment cards attached to a user’s machine.
Bay Area Labs researcher James Arnott said the Connective extension has more than two million weekly active users. Historic Connective marketing said its technology was used by eight of Belgium’s ten largest banks, more than 60 government agencies and departments, and over 1,000 enterprises.
The researchers cautioned that those historic deployment figures do not prove that every organisation used the specific browser extension affected by the vulnerabilities. The active-user figure, however, was independently visible through browser-extension distribution channels.
The central weakness involved the boundary between web content and the native signing application. Messages passed through the browser extension without the native component receiving sufficient information about the website origin behind the request. Activation tokens authorising functionality were also not tied tightly enough to a particular origin.
That opened several attack paths. The researchers demonstrated that a website could retrieve information from connected Belgian eID and Maestro cards and interfere with how the electronic identity PIN was handled. They also found that the application returned a PIN-related token containing both encrypted material and information needed to recover it.
A separate command allowed a web request to specify a library path that the native application would load. By combining relative paths with a downloaded file, the researchers demonstrated drive-by code execution at the user’s privilege level after a victim visited a malicious site with the affected software installed.
The exposure is more consequential than an ordinary browser-extension flaw because electronic identity infrastructure depends on a chain of trusted components. Banks, public authorities, and signing services may rely on the cryptographic identity assertion produced by the card while having little control over the browser-to-native software through which the request reaches it.
Nitro deployed remediation in stages. An initial change on 8 May introduced server-side origin checking, but the researchers said it did not fully address the PIN-token handling or library-loading route. A fuller patch followed on 1 June, disabling the vulnerable library command and changing how PIN state was handled.
Remote origin checks were enforced from 22 July, according to the disclosure, preventing arbitrary sites from silently reading eID information or initiating the same PIN-phishing flow.
The research does not establish that attackers used the vulnerabilities maliciously before remediation. Its findings are proof-of-concept demonstrations, and claims about affected organisations must remain separate from evidence that any individual bank or government body was compromised.
Nitro Software Belgium is listed as a Qualified Trust Service Provider under the EU’s eIDAS framework. The case therefore exposes a wider assurance question around software that sits inside regulated trust services: formal status and organisational certification cannot substitute for secure boundaries between ordinary web content and native software capable of invoking identity and signing functions.
