{"id":"tronbrowser.dev/tronbrowser","name":"tronbrowser","commands":["tron","tronbrowser"],"examples":[{"run":"tron <url>","does":"Open one or more URLs in TronBrowser"},{"run":"tron --tor <url>","does":"Open through Tor in a separate wiped profile (needs the tor daemon)"},{"run":"tron upgrade","does":"Update to the latest release, no-op if already current"}],"description":"Privacy-focused Chromium-based browser with a tron command for launching, upgrading and removing it.","homepage":"https://tronbrowser.dev","repository":"https://github.com/profullstack/tronbrowser.dev","license":"MIT","agentic":false,"latest_version":"3.19.6","vendor":"Profullstack","install":"curl -fsSL https://tronbrowser.dev/install.sh | sh","publisher":"profullstack","w3bs":"w3bs install tronbrowser.dev/tronbrowser","scan":{"status":"passed","scanner":"threatcrush 0.13.30","filesScanned":501,"summary":{"critical":0,"high":2,"medium":31,"low":21,"info":0},"malware":0,"truncated":false,"version":"3.19.6","sources":{"installer":"https://tronbrowser.dev/install.sh","installerSha256":"61ddec987719c700e8d11bc0def27529e93abe98fcee7b99db303501c8737477","repository":"github.com/profullstack/tronbrowser.dev"},"notes":[],"scannedAt":"2026-11-03T04:49:04.991Z","findings":[{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/apps/desktop/launcher/tron-tor-helper","line":303,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/apps/desktop/launcher/tron-tor-helper","line":437,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":188,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":428,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":446,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/apps/desktop/extensions/ai-sidebar/install-helper.js","line":156,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/desktop/extensions/ai-sidebar/media.js","line":34,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/desktop/extensions/ai-sidebar/media.js","line":57,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/desktop/extensions/ai-sidebar/newtab.js","line":247,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/desktop/extensions/ai-sidebar/newtab.js","line":276,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/desktop/extensions/ai-sidebar/newtab.js","line":346,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/desktop/extensions/ai-sidebar/options.js","line":306,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/desktop/extensions/ai-sidebar/sidepanel.js","line":78,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/desktop/extensions/ai-sidebar/sidepanel.js","line":166,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/apps/desktop/extensions/ai-sidebar/w3bs.js","line":17,"malware":false},{"ruleId":"insecure-randomness-for-secret","title":"predictable randomness used for a security value","severity":"medium","category":"code","cwe":"CWE-338","file":"source/apps/extensions/public/seal.js","line":107,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/extensions/public/store.js","line":77,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/extensions/public/store.js","line":286,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/extensions/public/store.js","line":652,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/app.js","line":29,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/dns.js","line":54,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"source/apps/web/public/install.sh","line":188,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"source/apps/web/public/install.sh","line":428,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"source/apps/web/public/install.sh","line":446,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/settings.js","line":122,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/settings.js","line":194,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/packages/sdk/src/mcp/tools.ts","line":125,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/packages/sdk/src/page.ts","line":68,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/packages/sdk/src/page.ts","line":73,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/services/api/src/profile.ts","line":59,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/services/api/src/store/db.ts","line":116,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/services/api/src/store/scanner.ts","line":44,"malware":false},{"ruleId":"sh-predictable-temp-path","title":"predictable temporary file","severity":"medium","category":"code","cwe":"CWE-377","file":"source/start.sh","line":24,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/apps/desktop/extensions/ai-sidebar/pit-proxy.test.js","line":8,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/packages/agent-runtime/src/analyze/form-script.test.ts","line":6,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/agent-runtime/src/analyze/form-script.test.ts","line":26,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/agent-runtime/src/analyze/form-script.test.ts","line":49,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/packages/browser-core/src/automation/extract-script.test.ts","line":6,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/browser-core/src/automation/extract-script.test.ts","line":16,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/browser-core/src/automation/extract-script.test.ts","line":45,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/browser-core/src/automation/extract-script.test.ts","line":57,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/browser-core/src/automation/extract-script.test.ts","line":80,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/browser-core/src/automation/extract-script.test.ts","line":99,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/packages/browser-core/src/automation/snapshot-script.test.ts","line":11,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/browser-core/src/automation/snapshot-script.test.ts","line":62,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/browser-core/src/automation/snapshot-script.test.ts","line":101,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/provenance/src/scan.test.ts","line":47,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/provenance/src/scan.test.ts","line":170,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/provenance/src/scan.test.ts","line":216,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/packages/sdk/src/mcp/automate.test.ts","line":299,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/storage/src/config.ts","line":51,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/storage/src/config.ts","line":51,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/services/api/src/store/scanner.test.ts","line":32,"malware":false},{"ruleId":"js-hardcoded-crypto-key","title":"hardcoded key material","severity":"low","category":"code","cwe":"CWE-321","file":"source/services/api/src/store/signing.test.ts","line":25,"malware":false}]}}