If the crypto operations are run in browser elements that are obviously part of the browser chrome and not the webpage, then they should be safe. As long as the end user knows the difference.
Eg, if the end user knows they can safely write a message and hit an encrypt button in a particular window opened by the browser, but not just any old textarea on the webpage.
Eg, if the end user knows they can safely write a message and hit an encrypt button in a particular window opened by the browser, but not just any old textarea on the webpage.