Web eID

ID: ncibgoaomkmdpilpocfeponihegamlic

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Active

Version

2.3.0

Size

0.07 MB

Rating

1.9/5

Reviews

127

Users

900,000

Type

Extension

Updated

Jul 10, 2024

Publisher Contextual Analysis

Trusted

Author: riaeeView Profile
Privacy: Privacy Policy
Help: Help Center
Country: EE
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Address: Pärnu mnt 139a Tallinn 11317 EE
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

1,415,219

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Use your electronic identification card for secure authentication and digital signing.

The Web eID extension enables the use of digital documents (ID-card, digital ID, e-Resident’s digital ID, residence permit card, etc.) for secure authentication and signing on the web. In addition to this extension, the Web eID native application must also be installed on the computer. Download the Web eID native application from here: https://www.id.ee/en/article/install-id-software/

User Growth

Showing data from Apr 05, 2024 to Apr 04, 2025

Versions

-10%(-100,000 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 101 ratings

Average Rating

Current: 1.87 / 5.0+0.39

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High0

Medium1

Low6

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.3.0 Code review	3
2.2.2 Code review	4

Extension Version	Code Review Findings
2.3.0	3
2.2.2	4

Files with findings

3 distinct paths — top paths by unique finding count:

content.js4
token-signing-page-script.js2
background.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Other	medium	content.js (line 1)	The content script runs on all URLs in all frames with broad host permissions (:///*). While this is expected for an eID extension that needs to be available on any website requesting authentication, the combination…	2.2.2
2	Code Injection	low	content.js (line 1333)	The content script injects a page-level script into every page (when TOKEN_SIGNING_BACKWARDS_COMPATIBILITY is enabled). This grants the injected script access to the page's JavaScript context, which is typical for eID…	2.3.0
3	Code Injection	low	content.js (line 1333)	The extension injects a page-level script into every webpage when TOKEN_SIGNING_BACKWARDS_COMPATIBILITY is enabled. This script creates a window.TokenSigning global API accessible to any page JavaScript. While this is…	2.2.2
4	Other	low	token-signing-page-script.js (line 71)	The deprecated TokenSigning page script uses postMessage with wildcard '*' target origin, which means any window (including malicious iframes) could intercept these messages containing signing requests. However, this …	2.3.0
5	Other	low	content.js (line 1384)	The content script listens to all window messages and forwards qualifying messages (web-eid actions and TokenSigning events) to the background script, which then communicates with the native app. This is the standard …	2.3.0
6	Other	low	token-signing-page-script.js (line 83)	The page script uses window.postMessage with targetOrigin '*' (wildcard), meaning messages containing signing requests are broadcast to all frames. While the content script validates event.source === window, the wildc…	2.2.2
7	Other	low	background.js (line 1491)	The extension connects to a native messaging host named 'eu.webeid'. This is the core mechanism of the extension — communicating with the local eID smart card software. While nativeMessaging itself is a sensitive perm…	2.2.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


developer.mozilla.org	/en-US/docs/Web/Security/Secure_Contexts	https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts
en.wikipedia.org	/wiki/List_of_ISO_639-1_codes	https://en.wikipedia.org/wiki/List_of_ISO_639-1_codes
github.com	/web-eid/web-eid-webextension	https://github.com/web-eid/web-eid-webextension#hwcrypto-compatibility
mozilla.org	/MPL/2.0/	http://mozilla.org/MPL/2.0/.
github.com	/mozilla/webextension-polyfill/issues/130/n	https://github.com/mozilla/webextension-polyfill/issues/130\n
developer.mozilla.org	/en-US/docs/Web/Security/Secure_Contexts/	https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts\
en.wikipedia.org	/wiki/List_of_ISO_639-1_codes/n	https://en.wikipedia.org/wiki/List_of_ISO_639-1_codes\n
github.com	/web-eid/web-eid-webextension	https://github.com/web-eid/web-eid-webextension#hwcrypto-compatibility\
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

works :)

Virko Võsu·22 Jul 2026

Well honestly most of times it works, but I think informational support in errors or help pages can be better. e.g. in my case it wasn't saying that software update is required, but saying that card is not supported, what is a kind of nonsense

Tikhon Scherbakov·2 Jul 2026

Garbage

Tommy Le·10 Jun 2026

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Web eID

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews