Kraken Wallet In-App Browser

Trail of BitsCode version: not recorded (see the report)

Audit · firm’s term: Security Assessment

Trail of Bits reviewed Kraken (Kraken Wallet In-App Browser) on 21 Nov 2024: 11 findings, 0 critical; 8 marked fixed, 3 open.

No open critical findings
Open the reportOpen Kraken’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High101
Medium104
Low103
HighQueued in-app browser requests may use permissions from other pagesFixed

The report gives no description here.

MediumHTTPS and Unicode URL filtering not enforced for HTML linksFixed

The report gives no description here.

MediumMissing certificate validation in electrum-clientFixed

The report gives no description here.

MediumTransaction confirmation screen may be suddenly switchedFixed

The report gives no description here.

MediumUnreadable signing textFixed

The report gives no description here.

LowA malicious page can overwhelm the wallet with WebView messagesFixed

The report gives no description here.

LowDisconnected dapps can still execute certain requestsFixed

The report gives no description here.

LowSignature scheme does not prevent message tamperingFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Kraken’s security record

Kraken
Audits2 audits by 1 firmLast audit Nov 2024, by Trail of Bits.
Critical findingsNo open critical findingsAcross 2 reports.
Open Kraken’s security record

Security firm

Trail of Bits

29 projects reviewed · 47 reports · latest Sep 2026

See Trail of Bits’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us