w3bs.AccountStart building
PACKAGES / Profullstack

tronbrowser

Privacy-focused Chromium-based browser with a tron command for launching, upgrading and removing it.

ThreatCrush · No malware found
INSTALLw3bs install tronbrowser.dev/tronbrowser

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install tronbrowser.dev/tronbrowserInstall tronbrowser and track it for updates
  2. tron <url>Open one or more URLs in TronBrowser
  3. tron --tor <url>Open through Tor in a separate wiped profile (needs the tor daemon)
  4. tron upgradeUpdate to the latest release, no-op if already current

Every option: tron --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in tronbrowser 3.19.6. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-03 04:49 UTC · threatcrush 0.13.30
Files
501 (installer + github.com/profullstack/tronbrowser.dev)
Findings
2 high · 31 medium · 21 low
54 other findings (not malware)
  • high
    outbound request to a non-constant URLsource/apps/desktop/launcher/tron-tor-helper:303py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/apps/desktop/launcher/tron-tor-helper:437py-ssrf-outbound-request · CWE-918
  • medium
    network output piped into a shellinstaller/install.sh:188sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellinstaller/install.sh:428sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellinstaller/install.sh:446sh-remote-script-execution · CWE-494
  • medium
    redirect to a non-constant destinationsource/apps/desktop/extensions/ai-sidebar/install-helper.js:156js-open-redirect · CWE-601
  • medium
    unescaped HTML renderingsource/apps/desktop/extensions/ai-sidebar/media.js:34js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/desktop/extensions/ai-sidebar/media.js:57js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/desktop/extensions/ai-sidebar/newtab.js:247js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/desktop/extensions/ai-sidebar/newtab.js:276js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/desktop/extensions/ai-sidebar/newtab.js:346js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/desktop/extensions/ai-sidebar/options.js:306js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/desktop/extensions/ai-sidebar/sidepanel.js:78js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/desktop/extensions/ai-sidebar/sidepanel.js:166js-unescaped-html-sink · CWE-79
  • medium
    regex with nested unbounded quantifierssource/apps/desktop/extensions/ai-sidebar/w3bs.js:17redos-nested-quantifier · CWE-1333
  • medium
    predictable randomness used for a security valuesource/apps/extensions/public/seal.js:107insecure-randomness-for-secret · CWE-338
  • medium
    unescaped HTML renderingsource/apps/extensions/public/store.js:77js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/extensions/public/store.js:286js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/extensions/public/store.js:652js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/app.js:29js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/dns.js:54js-unescaped-html-sink · CWE-79
  • medium
    network output piped into a shellsource/apps/web/public/install.sh:188sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellsource/apps/web/public/install.sh:428sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellsource/apps/web/public/install.sh:446sh-remote-script-execution · CWE-494
  • medium
    unescaped HTML renderingsource/apps/web/public/settings.js:122js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/settings.js:194js-unescaped-html-sink · CWE-79
  • medium
    dynamic code executionsource/packages/sdk/src/mcp/tools.ts:125js-dynamic-code-execution · CWE-95
  • medium
    dynamic code executionsource/packages/sdk/src/page.ts:68js-dynamic-code-execution · CWE-95
  • medium
    dynamic code executionsource/packages/sdk/src/page.ts:73js-dynamic-code-execution · CWE-95
  • medium
    unescaped HTML renderingsource/services/api/src/profile.ts:59js-unescaped-html-sink · CWE-79
  • medium
    SQL built from a template literal or f-stringsource/services/api/src/store/db.ts:116sql-template-interpolation · CWE-89
  • medium
    dynamic code executionsource/services/api/src/store/scanner.ts:44js-dynamic-code-execution · CWE-95
  • medium
    predictable temporary filesource/start.sh:24sh-predictable-temp-path · CWE-377
  • low
    dynamic code executionsource/apps/desktop/extensions/ai-sidebar/pit-proxy.test.js:8js-dynamic-code-execution · CWE-95
  • low
    dynamic code executionsource/packages/agent-runtime/src/analyze/form-script.test.ts:6js-dynamic-code-execution · CWE-95
  • low
    unescaped HTML renderingsource/packages/agent-runtime/src/analyze/form-script.test.ts:26js-unescaped-html-sink · CWE-79
  • low
    unescaped HTML renderingsource/packages/agent-runtime/src/analyze/form-script.test.ts:49js-unescaped-html-sink · CWE-79
  • low
    dynamic code executionsource/packages/browser-core/src/automation/extract-script.test.ts:6js-dynamic-code-execution · CWE-95
  • low
    unescaped HTML renderingsource/packages/browser-core/src/automation/extract-script.test.ts:16js-unescaped-html-sink · CWE-79
  • low
    unescaped HTML renderingsource/packages/browser-core/src/automation/extract-script.test.ts:45js-unescaped-html-sink · CWE-79
  • low
    unescaped HTML renderingsource/packages/browser-core/src/automation/extract-script.test.ts:57js-unescaped-html-sink · CWE-79
  • low
    unescaped HTML renderingsource/packages/browser-core/src/automation/extract-script.test.ts:80js-unescaped-html-sink · CWE-79
  • low
    unescaped HTML renderingsource/packages/browser-core/src/automation/extract-script.test.ts:99js-unescaped-html-sink · CWE-79
  • low
    dynamic code executionsource/packages/browser-core/src/automation/snapshot-script.test.ts:11js-dynamic-code-execution · CWE-95
  • low
    unescaped HTML renderingsource/packages/browser-core/src/automation/snapshot-script.test.ts:62js-unescaped-html-sink · CWE-79
  • low
    unescaped HTML renderingsource/packages/browser-core/src/automation/snapshot-script.test.ts:101js-unescaped-html-sink · CWE-79
  • low
    unescaped HTML renderingsource/packages/provenance/src/scan.test.ts:47js-unescaped-html-sink · CWE-79
  • low
    unescaped HTML renderingsource/packages/provenance/src/scan.test.ts:170js-unescaped-html-sink · CWE-79
  • low
    unescaped HTML renderingsource/packages/provenance/src/scan.test.ts:216js-unescaped-html-sink · CWE-79
  • low
    dynamic code executionsource/packages/sdk/src/mcp/automate.test.ts:299js-dynamic-code-execution · CWE-95
  • low
    Generic API Keysource/packages/storage/src/config.ts:51secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/packages/storage/src/config.ts:51secret-generic-credential · CWE-798
  • low
    dynamic code executionsource/services/api/src/store/scanner.test.ts:32js-dynamic-code-execution · CWE-95
  • low
    hardcoded key materialsource/services/api/src/store/signing.test.ts:25js-hardcoded-crypto-key · CWE-321

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/tronbrowser.dev/tronbrowser/badge.svg)](https://w3bs.org/packages/tronbrowser.dev/tronbrowser)