Without a built-in, well-audited, static browser mechanism no web service can ever be trusted with confidential data

That's why mega has a separate app: https://mega.co.nz/#chrome