[mQu]

Do I understand correctly that browsers obtain source code through bridge (local HTTP server?) from Avatar network or is it downloaded traditionally?

EDIT (from here to end): to clarify - my question is to assess security of the 'runtime' - if it's downloaded from the server what is there to stop malicious party from compromising the server and sending modified verification code?

Would it be downloaded through the bridge then (and only then) verification with block chain could be done on received updates (providing first d/l wasn't compromised). User browser would then access files exposed by the bridge.

At least this is how I imagine it but the OP overview is light on details.