There's nothing inherently wrong with browser-based crypto. Most issues arise when you try to e.g. replace like TLS with JavaScript to encrypt passwords before sending them to a server. SHA256 doesn't become broken simply because it's run in a browser.