A .NET Framework 3.5 SP1 Windows Update had silently installed the vulnerable plug-in into Firefox. This vulnerability has since been patched by Microsoft. , Firefox 3.6 had no known unpatched security vulnerabilities according to Secunia. Internet Explorer 8 had five unpatched security vulnerabilities; the worst being rated "Less Critical" by Secunia. Mozilla claims that all patched vulnerabilities of Mozilla products are publicly listed. On January 28, 2013, Mozilla was recognized as the most trusted internet company for privacy in 2012. This study was performed by the Ponemon Institute and was a result of a survey from more than 100,000 consumers in the United States. In February 2013, plans were announced for Firefox 22 to disable third-party cookies by default. However, the introduction of the feature was then delayed so Mozilla developers could "collect and analyze data on the effect of blocking some third-party cookies." Mozilla also collaborated with Stanford University's "Cookie Clearinghouse" project to develop a blacklist and whitelist of sites that will be used in the filter. Version 23, released in August 2013, followed the lead of its competitors by blocking iframe, stylesheet, and script resources served from non-HTTPS servers embedded on HTTPS pages by default. Additionally, JavaScript could also no longer be disabled through Firefox's preferences, and JavaScript was automatically re-enabled for users who upgraded to 23 or higher with it disabled. The change was made due to its use across the majority of websites, the potential repercussions on inexperienced users who are unaware of its impact, along with the availability of extensions such as NoScript, which can disable JavaScript in a more controlled fashion. The following release added the ability to disable JavaScript through the developer tools for testing purposes. In January 2015, TorrentFreak reported that using Firefox when connected to the internet using a VPN can be a serious security issue due to the browser's support for WebRTC. Beginning with Firefox 48, all extensions must be signed by Mozilla to be used in release and beta versions of Firefox. Firefox 43 blocked unsigned extensions but allowed enforcement of extension signing to be disabled. All extensions must be submitted to Mozilla Add-ons and be subject to code analysis in order to be signed, although extensions do not have to be listed on the service to be signed. On May 2, 2019, Mozilla announced that it would be strengthening the signature enforcement with methods that included the retroactive disabling of old extensions now deemed to be insecure. A Firefox update on May 3 led to bug reports about all extensions being disabled.