Bypassing the latest EU ageVerification app (2026.07-1) with a Chrome extension

О Release Release 2026.07-1 eu: 1 лее хо № Extensions - ох
Code Issues 5 —Pullrequests Actions Projects. Security and quality __Insights
А Please configure another 2FA method to reduce your risk of permanent account lockout. If you use
‘SMS for 2FA, we strongly recommend against SMS as it is prone to fraud and delivery may be View 2FA settings Хх
unreliable depending on your region.
Biometric authentication: new userauthenticationRequired Wallet Core config option skips app
authentication before credential presentation when the wallet already enforces biometrics on its keys.
Added error feedback (with da/de/fr/it translations) when biometrics are unavailable or not enrolled during
mandatory setup.
* Release build fixed: resolved R8 MissingClass problems by adding keep rules for ML Kit Text Recognition,
Google Play Services SafeParcelable/KeepName, and reflection-backed MRZ parser record classes.
* МВА scanner crash fixed: invalid crop dimensions from the viewfinder height calculation no longer crash
Bitmap.createBitmap ; crop coordinates are now bounds-checked and coerced,
* SpongyCastle -> BouncyCastle: replaced the deprecated SpongyCastle JCE provider with BouncyCastle in
с П @ Brave bravey//extensions |® А во злое 9=
= Extensions Q developermode ©)
Cicstrmpatied ) (inattention) (Cpaitas y
Find extensions and themes in the Web Store
Security PoC: EU Age Verification bypass via
software keys. For responsible disclosure only.
Inspect views service worker
@ srevestwayto experince iassvrdnyur
browser. Easily sign in to sites, generate
passwords, and store secure information.
Issue attributes for your Age Verification demo application.
For testing purposes only.
Mandatory Information
| Add Optional Attributes
Security research tool. Demonstrates EU AV framework =
@ Credential active — software key, no ID verification.
BM cpenicavp nttps://verdfier re.
For mobile login click here
This verter compatible withthe EU Age Vatiiation Profle, Veron
ye [] < verifier.ageverification... @|® A ав злое 9 =
Credential Accepted (HTTP 200)
Credential presented from Chrome extension.
No passport scanned. No face match. No hardware keys.
| PoC bypasses demonstrated:
X No passport or identity document scanned
X No face matching performed
Х No Pia Integrity / hardware attestation
] Х Same credential reused (one-time-use bypassed)
You must be at least 18 years old
This verifier is erate nthe EU Age Vein Prati, arson