CFCA CryptoKit.GZRailway Extension

The extension appears to be related to CFCA (China Financial Certification Authority) and railway systems in Guangzhou, suggesting a legitimate business purpose for cryptographic operations. However, several concerning factors significantly impact trustworthiness: no visible download count, no user ratings or reviews, missing author and developer information, and no recent update timestamp. These missing details make it impossible to verify the extension's legitimacy or assess its community acceptance.

The combination of nativeMessaging permission with broad host permissions creates significant security risks. The extension can communicate with native applications on your computer while accessing multiple domains including local host addresses (127.0.0.1). This configuration could potentially allow data exfiltration from your local system or enable the extension to act as a bridge between web content and local applications. The broad host permissions extend beyond just railway-related domains to include perfectsign.com.cn and localhost access, which seems excessive for a railway-specific cryptographic tool.

Given the high-risk permission combination and lack of transparency about the developer, install this extension only in a separate Chrome profile if absolutely necessary for railway-related business operations. Verify the extension's authenticity through official CFCA or railway company channels before installation. Monitor system activity when the extension is active and consider using network monitoring tools to observe any unexpected data transmission.