@Br0m3x @rysiek If the javascript had all come from cryptpad.fr, it would have posed no problem with uMatrix. But the js was 3rd party from sandbox.cryptpad.info, so uMatrix disabled it by default.