The Elfsight Incident: When a Widget Vendor Controls Code Inside the White House App

Yes, the incident illustrates exactly the risk that PCI DSS requirements 6.4.3 and 11.6.1 were written to address. Requirement 6.4.3 requires an inventory of all scripts on payment pages, written justification for each, and assurance of script integrity. Requirement 11.6.1 requires a mechanism to detect unauthorized changes to payment page scripts and headers. A widget vendor that can silently change which JavaScript your payment pages execute is precisely the scenario these controls target. If Elfsight or any remotely served widget runs on your payment pages, it must be inventoried, justified, and monitored.

You can detect Elfsight by checking your pages for scripts loading from Elfsight-controlled domains, typically added through a copied embed snippet for a social feed, gallery, form, or review widget. In practice, these widgets are often added by marketing teams, agencies, or page builders and forgotten, so manual checks are unreliable. A continuous third-party monitoring platform like Reflectiz inventories every script running on your site, including Elfsight widgets and the fourth-party code they load, without installing any agent. Reflectiz offers a free scan to check whether Elfsight exists on your site.

Reflectiz continuously monitors your live website from the outside, exactly as your users experience it, with no agent and no code installed on your site. It builds a complete inventory of every third-party and fourth-party script, then tracks what each one actually does in the browser: what it loads, where it sends data, and which cookies it drops. When a widget vendor’s servers start serving different code or a script’s behavior changes, Reflectiz alerts you within hours. This behavioral, agentless approach catches the exact class of risk the Elfsight incident exposed, which static reviews and questionnaires miss.

Not necessarily, but you should make an informed, documented decision. First, identify every page where Elfsight loads and what data flows it generates. Second, assess whether the widget appears on sensitive pages such as payment, login, or account pages, where remotely served code carries the highest risk and PCI DSS obligations apply. Third, if you keep it, place it under continuous monitoring so any change in its behavior triggers an alert. If you cannot justify the widget’s presence or monitor it, removal is the safer option. Reflectiz can scan your site for free to show you where Elfsight and similar widgets are running.

No compromise or malicious activity by Elfsight has been reported. The issue is exposure, not a confirmed breach. Elfsight’s servers had the technical ability to decide which JavaScript ran inside a mandatory federal government app, and the app’s observed network behavior contradicted its own privacy label. Elfsight stated it has never received a data request from Russian authorities, and the White House said the vendor passed a security review. Neither statement removes the structural risk of remotely controlled third-party code.

A third-party widget supply chain attack occurs when code embedded from an external vendor is used to compromise the websites or apps that load it. Because widgets are served from the vendor’s infrastructure, an attacker who compromises the vendor, or a vendor who changes behavior deliberately, can push malicious JavaScript to every site using the widget simultaneously. Well-known examples include Magecart payment skimming campaigns and the Polyfill.io takeover, where a trusted script source began serving malicious code to thousands of sites at once.

Elfsight is a software vendor that sells pre-built, embeddable website widgets such as social media feeds, image galleries, forms, and calculators. The widgets load directly from Elfsight’s servers, meaning Elfsight controls the code that runs on any site or app that embeds them. Elfsight markets itself as a European company headquartered in Andorra, but it was founded in 2016 in Tula, Russia, and investigative reporting confirmed its original Russian entity remains active, with growing revenue and continued hiring of Russian staff into 2026.

The Elfsight incident refers to the 2026 discovery that the official White House mobile app, mandated on US federal government devices, ran JavaScript code served by Elfsight, a widget vendor founded in Russia that still maintains active Russian operations. A network traffic analysis by security firm Atomic Computer found that Elfsight’s servers determined which JavaScript files executed inside parts of the app, and that the app accepted more than ten cookies from Elfsight along with Google DoubleClick advertising domains, despite a privacy label claiming no data collection or tracking.

The White House stated that Elfsight passed a full security review, which highlights the limitation of point-in-time assessments. A static review evaluates the code and vendor at the moment of approval, but remotely served widgets can change behavior at any time after approval. The Atomic Computer analysis found behavior, including tracking cookies and advertising domains, that contradicted the app’s privacy label, which only became visible by observing actual network traffic. Vendor questionnaires audit intentions; only continuous behavioral monitoring audits what third-party code actually does.

Elfsight is considered a supply chain risk because its widgets execute remotely served JavaScript that the vendor can change at any time, for any user, without the website owner’s knowledge. In addition, Elfsight’s active Russian entity is subject to Russian data laws, which can compel companies operating in Russia to store data locally and disclose it to state authorities on request. The risk is structural: any embedded widget that loads from a vendor’s servers gives that vendor ongoing control over code running in your visitors’ browsers.