Update about reported XSS issue

Share this page

A couple of days ago, a video was circulated online that claimed Proton Mail is susceptible to a XSS (cross-site scripting) issue which raised some concerns among Proton Mail users. We want to clarify that this does not impact the current version of Proton Mail.

XSS issue

Proton Mail is constantly making security improvements through our beta process and we appreciate all the assistance we have received from the community in helping us make Proton Mail better. The concept of encrypting on the client side is a relatively new one and comes with its own security challenges which we are working diligently to tackle.

The Proton Mail security team has reviewed the video and confirmed that this particular security issue is not present on the live version of Proton Mail. The video is showing an earlier development version of Proton Mail that was originally released on May 10, 2014 for limited testing, and is not used in the current production systems.

We are supportive of all efforts to improve the security of Proton Mail and appreciative of our security contributors. Security inquiries can always be directed to security@proton.me

Share this page

Related articles

  • Privacy Basics
Gmail is not end-to-end encrypted, and Google retains access to all your emails. Here are five steps to make Gmail more secure and the best alternative if you’re looking for genuine privacy. We explain why Gmail is not completely secure or private,
October is European Cybersecurity Month, making this the perfect time to assess your security. We’re sharing some of our most important cybersecurity guides to help.  At Proton, your security is our top priority. We believe your data belongs to you
Emails you send with most email providers aren’t private. We explain how to add password protection or enhanced encryption to messages in Gmail and Outlook and how to send a genuinely private email with Proton Mail. You can password-protect emails i