Don't allow the user to install extensions from web
Tor browser for Android doesn't verify if the torbutton extension has a signature to install it. Thus, if someone sends a tampered torbutton extension to the user, they can install it.
Tor browser for Android doesn't verify if the torbutton extension has a signature to install it. Thus, if someone sends a tampered torbutton extension to the user, they can install it.