Parents: That "Age Verified" Label Just Got Beaten by a Chrome Extension

A security researcher just beat a two-million-euro age verification app using a browser extension he built with A.I. And here's the part that stings, he did it twice. Once in April. Then again three months later, after the European Union spent an entire summer patching it.

If you're a parent, you've probably seen that

If you're a parent, you've probably seen that little "age verified" badge on an app or a game. It's meant to tell you the kids on the other side are old enough to be there. This story is about what that badge actually promises, and what it doesn't. The European Commission hired a German-Swedish team back in January to build a national age check system. They signed a two-million-euro contract. Two years of work. The plan was to roll it out across Europe by early next year. So how did one researcher tear through it in under two minutes?

Let's start with that first bypass, back in April. The Commission unveiled the app. The researcher, his name is Paul Moore, sat down with it. In less than two minutes, he was through. Not with some elite hacking rig. He used a Chrome extension. A small piece of code that runs inside your web browser, the same kind you might install to block ads. For a normal person, that's the shock. This wasn't a basement full of servers. It was a browser add-on. Previously in this series: Eu Age Verification App Bypassed Chrome Extension Parent Saf.

Now, the team behind the app did what you'd expect. They patched it. Their public code shows more than two thousand fixes and changes over time. Months of hardening. Then Moore came back and broke it again, using the same basic trick.

That's the detail that matters

That's the detail that matters. Moore's argument is that the flaw isn't a bug you can patch. It's baked into the design. The app was built so that no one, not even the government, sees your private data. A privacy-first approach. But that same design means a user who simply doesn't want to hand over a real face or a real I.D. can slip around every check. You can't patch your way out of that. You'd have to rebuild the whole thing. Up next: Eu Age Verification App Bypassed Chrome Extension Parent Saf.

Here's why this reaches past one app. This age check system isn't a standalone tool. It's meant to plug into Europe's new digital identity wallets. Those are planned for all twenty-seven member countries, roughly four hundred and fifty million people, by the end of next year. So a crack in this foundation isn't a small leak. It runs under the whole house.

And listen to the gap in how this was sold. The Commission's president, Ursula von der Leyen, called the app easy to use, privacy-preserving, and open source. She said it was about putting power back in the hands of parents. The researcher who tested it says, plainly, it doesn't reliably do the one job it exists to do. Confirm someone's age.