extension verification flaw