This blog post reports on a security review conducted by the Open Technology Fund, which exposed three significant vulnerabilities in the NoScript browser extension. These included an XSS filter bypass and issues with CSP injection on Chromium-based browsers, leading to script execution through SVG files, as well as a bug disabling a key anti-deanonymization feature. All the vulnerabilities have been addressed and fixed.