By that logic all cloud synced password managers are insecure. They could, after all, just update the software and steal your password(s).<p>JavaScript or not, you either trust the browser vendor, or you do not. If you do not then you shouldn&#x27;t be using them regardless of the technologic stack.