Web eID

Web eID

ID: ncibgoaomkmdpilpocfeponihegamlic

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
2.3.0
Size
0.07 MB
Rating
1.8/5
Reviews
126
Users
900,000
Type
Extension
Updated
Jul 10, 2024
Category
Workflow & planning
Price
Free
Featured
No
Visibility
Unlisted
Mature
No
By Google
No
Trusted
Yes

Publisher Contextual Analysis

Trusted
Author
riaeeView Profile
Country
EE
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Address
Pärnu mnt 139a Tallinn 11317 EE
Website
Visit
Total Extensions
2
Active
1
Obsolete
1
Listed
0
Unlisted
2
Total Users
1,415,219
Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4

Use your electronic identification card for secure authentication and digital signing.

The Web eID extension enables the use of digital documents (ID-card, digital ID, e-Resident’s digital ID, residence permit card, etc.) for secure authentication and signing on the web. In addition to this extension, the Web eID native application must also be installed on the computer. Download the Web eID native application from here: https://www.id.ee/en/article/install-id-software/

Item
Type
Severity
Description
*://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
nativeMessaging
Permission
High
This permission enables communication with applications installed on your computer. Rated High because it can exchange data with native programs, potentially exposing system-level information and local files.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.

The deprecated TokenSigning page script uses postMessage with wildcard '*' target origin, which means any window (including malicious iframes) could intercept these messages containing signing requests. However, this is a known pattern in the deprecated backwards-compatibility API, and the content script validates event.source === window before processing responses.

token-signing-page-script.js (Line 71)
function messagePromise(msg) {  if (!hasDeprecationWarningDisplayed) {    console.warn("TokenSigning API is deprecated. Please consider switching to the new Web-eID library.");    hasDeprecationWarningDisplayed = true;  }  return new Promise(function(resolve, reject) {    window.postMessage(msg, "*");    eidPromises[msg.nonce] = {      resolve,      reject    };  });}

The content script injects a page-level script into every page (when TOKEN_SIGNING_BACKWARDS_COMPATIBILITY is enabled). This grants the injected script access to the page's JavaScript context, which is typical for eID extensions that need to expose a signing API to web pages. The script is loaded from the extension's own resources, not from an external URL.

content.js (Line 1333)
function injectPageScript() {  if (!document.querySelector("script[data-name='TokenSigning']")) {    const s = document.createElement("script");    s.type = "text/javascript";    s.dataset.name = "TokenSigning";    s.dataset.by = "Web-eID extension";    if (browser.runtime.getManifest()["manifest_version"] >= 3) {      s.src = browser.runtime.getURL("token-signing-page-script.js");    } else {      s.innerHTML = "(" + pageScript + ")();";    }    (document.head || document.documentElement).appendChild(s);  }}

The content script listens to all window messages and forwards qualifying messages (web-eid actions and TokenSigning events) to the background script, which then communicates with the native app. This is the standard architecture for eID extensions. The message validation checks event.source === window and validates action prefixes, limiting the attack surface.

content.js (Line 1384)
window.addEventListener("message", async (event) => {        var _a;        if (isWebeidEvent(event)) {          if (event.data.action === Action$1.WARNING)            return;          config.DEBUG && console.log("Web-eID event: ", JSON.stringify(event));          if (!window.isSecureContext) {            const response = {              action: event.data.action + "_FAILURE",              error: new ContextInsecureError(),            };            window.postMessage(response, event.origin);          } else {            let response;            switch (event.data.action) {              case Action$1.STATUS: {                window.postMessage({                  action: Action$1.STATUS_ACK                }, event.origin);                response = await send(event.data);                break;              }

By severity

Critical0
High0
Medium1
Low6

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
2.3.03
2.2.24

Files with findings

3 distinct paths — top paths by unique finding count:

  • content.js4
  • token-signing-page-script.js2
  • background.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Other
medium
content.js (line 1)The content script runs on all URLs in all frames with broad host permissions (*://*/*). While this is expected for an eID extension that needs to be available on any website requesting authentication, the combination…
2Code Injection
low
content.js (line 1333)The content script injects a page-level script into every page (when TOKEN_SIGNING_BACKWARDS_COMPATIBILITY is enabled). This grants the injected script access to the page's JavaScript context, which is typical for eID…
3Code Injection
low
content.js (line 1333)The extension injects a page-level script into every webpage when TOKEN_SIGNING_BACKWARDS_COMPATIBILITY is enabled. This script creates a window.TokenSigning global API accessible to any page JavaScript. While this is…
4Other
low
token-signing-page-script.js (line 71)The deprecated TokenSigning page script uses postMessage with wildcard '*' target origin, which means any window (including malicious iframes) could intercept these messages containing signing requests. However, this …
5Other
low
content.js (line 1384)The content script listens to all window messages and forwards qualifying messages (web-eid actions and TokenSigning events) to the background script, which then communicates with the native app. This is the standard …
6Other
low
token-signing-page-script.js (line 83)The page script uses window.postMessage with targetOrigin '*' (wildcard), meaning messages containing signing requests are broadcast to all frames. While the content script validates event.source === window, the wildc…
7Other
low
background.js (line 1491)The extension connects to a native messaging host named 'eu.webeid'. This is the core mechanism of the extension — communicating with the local eID smart card software. While nativeMessaging itself is a sensitive perm…
URLs
9
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

developer.mozilla.org/en-US/docs/Web/Security/Secure_Contextshttps://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts
en.wikipedia.org/wiki/List_of_ISO_639-1_codeshttps://en.wikipedia.org/wiki/List_of_ISO_639-1_codes
github.com/web-eid/web-eid-webextensionhttps://github.com/web-eid/web-eid-webextension#hwcrypto-compatibility
mozilla.org/MPL/2.0/http://mozilla.org/MPL/2.0/.
github.com/mozilla/webextension-polyfill/issues/130/nhttps://github.com/mozilla/webextension-polyfill/issues/130\n
developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts/https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts\
en.wikipedia.org/wiki/List_of_ISO_639-1_codes/nhttps://en.wikipedia.org/wiki/List_of_ISO_639-1_codes\n
github.com/web-eid/web-eid-webextensionhttps://github.com/web-eid/web-eid-webextension#hwcrypto-compatibility\
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Showing 1 to 2 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.