Belgium eID Browser Extension Bugs Enable RCE

Confirmed: severe vulnerabilities in the browser extension underpinning Belgium’s national electronic identity (eID) system fully compromised the country’s citizen authentication trust framework, enabling remote code execution against user accounts, according to Dark Reading research published August 13.

Belgium’s eID cards are the primary authentication mechanism for millions of citizens accessing government services, banking portals, and health records. The authentication flow depends on a browser extension that bridges the smart card reader to web services. When that extension is compromised, the trust chain collapses at its foundation — the card itself is irrelevant if the software layer mediating its use is hostile.

What researchers found

The extension ran under elevated browser privilege — the necessary access for reading smart card interfaces. Researchers found the vulnerabilities severe enough to characterize the trust model as “fully compromised.” Specific CVE assignments had not been disclosed publicly as of this report. Confidence on exploitation status: unconfirmed in the wild; treat as theoretical unless updated.

The research frames the Belgium case as an instance of a broader structural problem: browser extensions used as authentication proxies represent a high-value target that routinely receives less scrutiny than the underlying protocols they serve. Extensions run persistent, privileged code in the browser context — enough access to intercept authentication tokens, relay credentials, or stage local execution.

Scope

Belgium’s eID is issued to all Belgian citizens and resident aliens over 12 years old. The extension is required — not optional — for completing authentication to the government’s digital services platform (MyGov/CSAM) and for many banking integrations. Precise affected version range: unconfirmed pending vendor advisory publication.

What to do

• Belgian citizens: Verify the eID browser extension is updated to its latest available version in your browser’s extension manager. Disable automatic activation of the extension on non-government sites if your browser permits granular host permissions.
• IT administrators and organizations relying on eID for workforce authentication: Monitor the Belgian Centre for Cyber Security (CCB) for an official advisory and patch timeline. Apply updates on an emergency basis once available — this is a national identity infrastructure issue, not a routine patch cycle item.
• Security teams: Review any service-side session logs for anomalous authentication activity originating from Belgian eID flows. Flag for inspection pending the full technical disclosure.

[Analysis] Browser extensions continue to widen enterprise attack surface in ways that perimeter-focused defenses miss. A compromised extension that is trusted by both the browser and the authentication server has the same effective access as the legitimate user — without triggering most authentication anomaly detections. National identity implementations that depend on extension-mediated smart card auth face the same supply chain risk as any other extension, with significantly higher blast radius. End-analysis.

Source: Dark Reading, August 13, 2026 — Belgian Centre for Cyber Security