Web browsers cannot directly access local security hardware or native certificate management software. This extension provides the communication channel between Shanghai Rural Commercial Bank's web-based certificate enrollment pages and the user's local CFCA security toolkit (native messaging host), enabling certificate operations that require local system access.

1. User navigates to the bank's certificate enrollment page on srcb.com or shrcb.com. 2. The web page sends a 'connect' message to the extension via chrome.runtime.sendMessage. 3. The extension establishes a native messaging port to the local CFCA security application. 4. The web page sends certificate operation requests, which the extension forwards to the native host. 5. Results are returned through the extension back to the web page. 6. When done, the web page sends 'disconnect' to tear down the connection.

Target users: Customers of Shanghai Rural Commercial Bank (SRCB) who need to enroll or manage CFCA digital certificates through the bank's web interface / Users requiring CFCA (China Financial Certification Authority) security certificate operations in a browser context

The extension's source is minimal (139 lines in eventPage.js) and fully readable, giving high confidence in the functional analysis.
Cannot verify the native messaging host application (the actual CFCA security toolkit) as it is installed separately on the user's machine.
Cannot confirm the exact authentication requirements of the destination banking website from extension code alone.

Monetization

No paid features detected

The extension contains no payment logic, no upgrade prompts, no subscription checks, and no gating of features behind paid tiers. It is a simple technical bridge (native messaging proxy) with a single free workflow. The destination banking service may have its own account/billing, but the extension itself has no paid features.

Confidence: 85
Payment platform: --
Source: AI / High
Login required: Yes
Reason: The extension is a bridge between banking web pages (srcb.com / shrcb.com — Shanghai Rural Commercial Bank) and a local native messaging host for certificate enrollment. The extension itself has no login UI or authentication logic, but the core workflow requires the user to be on the bank's website performing certificate operations, which presupposes the user has a bank account and is likely authenticated on the destination service.

Permission risk

High-risk permissions

This estimate uses declared permissions and host permissions to assess access scope and sensitivity.

敏感权限：nativeMessaging

Publisher

developer.srcb

Independent publisher

Email: [email protected]
Phone: --
Address: --

Public contact fields are shown above. Developer portfolio pages are available on paid accounts.

View developer portfolio

Permissions

Host access