On: OpenPGPjs has passed an independent security audit

[detaro]

Not if the originating site is the potential attacker, which was the initial scenario: Protonmail sending you page that leaks your decrypted mail to them.