Researchers found that Belgium’s widely used Connective signing extension could expose eID and Maestro card data, recover PINs and execute attacker-controlled code through its native host. The flaws were fixed in July, but the case shows how a powerful browser extension can quietly undermine an otherwise strong national identity system.