*Note: this question might have been better on the [Tor community][1] despite being on-topic here.*

Thomas Roth demonstrated that [Protonmail][2] was vulnerable to a [Cross-site scripting (XSS) attack.][3]

[The video (Vimeo)][4] he made shows that at least the mail body was vulnerable to Javascript injection. As soon as the receiver read the mail, the code is executed. Unfortunately, this code can be malicious and can, among other things, deanonymize the user. The FBI showed that it was possible when they seized Freedom Hosting. (Although they exploited a [0-day][5] in Firefox.)

Using the [Tor browser][6] with Javascript enabled is risky. Disabling it will reduce the attack surface. The Tor developers are aware of this issue and address it in their [FAQ:][7]

> **Why is NoScript configured to allow JavaScript by default in Tor Browser? Isn't that unsafe?**
> 
> We configure NoScript to allow JavaScript by default in Tor Browser
> because many websites will not work with JavaScript disabled. Most
> users would give up on Tor entirely if a website they want to use
> requires JavaScript, because they would not know how to allow a
> website to use JavaScript (or that enabling JavaScript might make a
> website work).

The Tor browser gives you the opportunity to disable JavaScript (with the NoScript plugin). However, as you may have noticed, [Protonmail relies importantly on JavaScript,][8] and disabling it would prevent you from using their service:

> **Why do you need JavaScript, Session Storage, and Cookies?**
> 
> ProtonMail does encryption and decryption of messages in your web
> browser.
> 
> This ensures that we do not have the ability to independently decrypt
> your messages and thus ensures the security and privacy of your data.
> In order to do encryption and decryption in your web browser, **we need
> to use JavaScript for the encryption/decryption** and SessionStorage for
> saving your private key(s) locally. ProtonMail also requires cookies
> to be enabled so that we can store your current session information
> and log you into your account.

<sup>(Last emphasis is mine.)</sup>

Therefore you have to make a choice. Either you decide to trust Protonmail to be secure (even though vulnerabilities have been found); or you walk away and find another solution.

PS: If you're concerned about your privacy/anonymity, don't choose a service based on how it looks. :-)


  [1]: http://tor.stackexchange.com "Tor.SE"
  [2]: https://www.protonmail.com "Protonmail"
  [3]: https://en.wikipedia.org/wiki/Cross-site_scripting "XSS on Wikipedia"
  [4]: https://vimeo.com/99599725 "Thomas Roth's video on Vimeo"
  [5]: https://en.wikipedia.org/wiki/Zero-day_(computing) "0-day on Wikipedia"
  [6]: https://www.torproject.org/projects/torbrowser.html.en "Tor browser"
  [7]: https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled "Why is NoScript configured to allow JavaScript by default in Tor Browser? Isn't that unsafe? on Tor broswer FAQ"
  [8]: https://protonmail.com/support/knowledge-base/javascript-session-storage-cookies/ "Why do you need JavaScript, Session Storage, and Cookies? on Protonmail.com"