Comment by davej

> At the end of the day, window.crypto can be absolutely anything.

Would it be possible to toString() the function and check if it is a native function before execution? Seems like a simple solution but perhaps I'm missing something? I guess in theory the toString() method could also be hijacked. :-/