Millions of Belgians' IDs and bank accounts were wide open through a government browser extension
A browser extension used by more than 2 million Belgians to log into government and banking websites contained flaws so serious that criminals could have stolen identities, hijacked payment cards, and taken full control of victims' computers. The vendor fixed the problems on 22 July.
Key points
- A browser extension called Connective, used by more than 2 million Belgian citizens to log into government and banking sites, contained multiple critical security flaws disclosed publicly at DEF CON 34 on 9 August 2025.
- Researcher James Arnott of Bay Area Labs found that criminals could have stolen identity card data, hijacked Mastercard Maestro payment cards, and run malicious software on victims' computers without any interaction beyond visiting a harmful website.
- The most serious flaw allowed any website to silently load and run an arbitrary file on a victim's computer, a form of attack called remote code execution (RCE).
- Nitro Software Belgium, which makes Connective, patched all reported vulnerabilities on 22 July 2025.
- Arnott says comparable flaws exist in similar extensions used by militaries, courts, banks, and hospitals worldwide.
What is Connective and why did so many Belgians use it?
Connective is a browser extension, a small add-on program that runs inside a web browser, built to let Belgian citizens log into secure government and banking websites using their physical electronic ID card (eID). Belgium issues smart cards, physical cards with an embedded chip that stores identity information, and Connective bridges those cards with websites that require them.
According to its own Chrome Web Store page, the extension has more than 2 million individual users. Vendor Nitro Software Belgium claimed in 2021 that it served more than 60 government agencies and eight of Belgium's ten largest banks.
The login process is more involved than a typical username and password. A citizen needs the physical ID card, a card reader plugged into their computer via USB, software installed on their machine, and the Connective browser extension to tie everything together. In theory, requiring the physical card makes the system very hard to abuse remotely.
In practice, the extension broke that assumption badly.
How could criminals have broken in?
Criminals could have stolen identities and bank access with relatively little effort, before the July patch.
Researcher James Arnott, whose findings were first reported by Dark Reading, presented the details at DEF CON 34, an annual security research conference. His team found four distinct problems.
| Flaw | What it let an attacker do | Fixed |
|---|---|---|
| Reusable activation token | Impersonate any trusted site to the eID system | 22 July 2025 |
| PIN sent with its own decryption key | Read a victim's PIN code in plain text | 22 July 2025 |
| PIN pop-up controlled by the webpage | Trick victims with a fake prompt | 22 July 2025 |
| Host app loaded any file on command | Run malicious software on the victim's computer | 22 July 2025 |
The token problem was particularly elegant to exploit. Connective used a generic pass, called an activation token, to decide whether a website was allowed to talk to a citizen's eID. Arnott's team found they could simply copy a valid token from one legitimate Belgian site and present it to Connective from a fake site. Connective accepted it without question, handing the attacker full access to the eID authentication process.
PIN codes travelled encrypted, which sounds safe. The trouble is the decryption key travelled alongside them. That is roughly equivalent to locking a safe and taping the combination to the door.
The RCE flaw, where an attacker can run any program they choose on a victim's machine, was the most severe. The Connective host software, the program installed on the computer rather than the browser add-on, would obediently load and run any file a website told it to. A criminal could have sent a victim a phishing email (a fake message designed to trick someone into clicking a link) that automatically downloaded a harmful file, and Connective would have run it. No login page required.
Should affected users do anything now?
The vulnerabilities are patched. Users running the current version of Connective are no longer exposed to these specific flaws.
That said, some practical steps are worth taking regardless.
Check your bank statements for any transactions you do not recognise from the past several months. If you use itsme, the smartphone-based alternative to the physical card reader, review which phone number is registered to your account; an attacker who stole your eID signature could have re-registered itsme to their own device. Contact your bank directly if anything looks unfamiliar.
Arnott also notes that users can limit any browser extension's reach by going into extension settings and restricting it to run only on specific, trusted websites. It takes a few minutes to set up, and it meaningfully reduces the damage a flawed extension can do.
Finally, keep browser extensions updated automatically. Patches only protect you once they are installed.
