What Is Browser Based Mining Script? Definition & Examples

A browser based mining script is JavaScript that runs inside a visitor’s browser and uses local processing power to mine cryptocurrency for an attacker. It typically relies on a compromised website or ad network to execute. The script often works quietly in the background, making detection difficult without monitoring.

How Browser Based Mining Scripts Work

Browser based mining scripts are usually delivered through compromised sites, injected ads, or malicious third-party JavaScript. Once loaded, they consume CPU, battery, and bandwidth in the background while trying to remain visually unobtrusive to the visitor.

The defining trait is opportunistic execution inside an otherwise legitimate browser session. That means the script depends less on a special payload and more on trust in the page, the ad chain, or any embedded code that the browser is allowed to execute.

Because the activity happens client-side, defenders often see symptoms rather than a clean event trail: slower devices, hotter laptops, fan noise, dropped performance, and unusual script activity. Browser security and web content integrity are therefore central to understanding the technique, not just the mining logic itself.

Why This Technique Is Attractive to Attackers

Browser mining is attractive because it scales through ordinary web traffic and can monetize large numbers of low-friction, short-lived sessions. The attacker does not need to install software on the endpoint if the browser can be persuaded to run the code for them.

It also benefits from ambiguity. A page that is simply slow or resource-heavy can look like a normal performance issue, which gives the script time to run before users or security tools connect the symptoms to abuse. That makes it a practical form of stealthy resource theft, especially when the delivery point is a compromised site or ad network.

In some cases, the value is not just the cryptocurrency output itself but the proof that trusted web delivery paths can be abused at scale. A single injection point can affect many visitors, which turns a web compromise into a broad client-side abuse channel.

Security Implications and Detection Clues

The main security issue is that browser based mining scripts turn user devices into unwilling compute providers. That creates performance degradation, higher power usage, reduced battery life, and in some environments an increased support burden or degraded productivity.

Detection usually depends on correlating browser behavior with resource anomalies. Unusually sustained CPU usage, heavy JavaScript execution, unfamiliar third-party script hosts, and performance drops that persist only while a particular page is open are all practical clues. Monitoring web content and script sources matters because the activity may never touch traditional malware controls.

From a defensive perspective, this is also a supply-chain and web-delivery integrity problem. If an ad tag, analytics embed, or third-party script path is compromised, the browser can become the execution environment for abuse without any obvious change to the site’s visible content.

Practical Response and Prevention

Practitioners should treat browser mining as a web integrity issue first and a performance issue second. Blocking or restricting untrusted third-party scripts, tightening content security controls, and reviewing ad and tag dependencies reduce the number of places where mining code can hide.

Monitoring should focus on the browser layer and the page-delivery layer together. If users report fan spikes, device heat, or unexplained slowdowns on specific sites, correlate those reports with script behavior, domain reputation, and recent site changes rather than assuming the problem is local hardware.

For risk visibility, it helps to remember that the threat often rides on compromised trust rather than sophisticated payload design. W3C browser and web standards matter here because the browser is the execution platform, while OWASP API Security Top 10 and OWASP Non-Human Identity Top 10 become relevant when the delivery chain or embedded service dependencies are abused to introduce hostile code.

Risk and Threat Considerations

Browser based mining scripts are attractive because they can hide inside trusted web delivery paths and exploit the browser’s default permission to execute JavaScript. The risk is not only unauthorized resource use, but also the possibility that a compromised site or ad dependency quietly turns a large visitor base into a distributed mining pool.

Failure mechanism: An attacker compromises a site, tag, or third-party script and injects code that keeps running while the page remains open, using the victim’s CPU and power budget for mining. If the script is lightweight and intermittent, basic monitoring may miss it until users notice degraded device performance.

Impact: Organisations can see slower endpoints, higher battery drain, user frustration, and a broader sign of web trust failure. In larger environments, the same technique can also indicate that a browser-facing dependency has been compromised and could be used for other malicious script-based activity.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS 2 — Inventory and Control of Software Assets	Browser-delivered mining often enters through web scripts and third-party assets.
	CIS 4 — Secure Configuration of Enterprise Assets and Software	Hardening browser and content settings reduces exposure to hostile script execution.
	CIS 16 — Application Software Security	Compromised websites and injected code paths make application integrity central to this threat.
Recommendation — Inventory and control browser-delivered script sources and remove unapproved dependencies. Harden browser and content settings to limit execution of untrusted web code. Review web application dependencies and protect the integrity of delivered JavaScript.
NIST CSF 2.0	PR.DS — Data Security	Browser mining abuses delivered web content and the trust boundary around page assets.
	DE.CM — Continuous Monitoring	Detection depends on spotting unusual browser resource use and script behaviour.
Recommendation — Protect delivered web assets and restrict untrusted script execution paths. Monitor browser activity and web traffic for anomalous script execution patterns.
MITRE ATT&CK	T1059.007 — JavaScript	Browser based mining uses JavaScript as the execution mechanism in the browser.
	T1189 — Drive-by Compromise	Users can be exposed through compromised sites or injected web delivery paths.
	T1496 — Resource Hijacking	Cryptomining is a direct resource-hijacking outcome of this browser technique.
Recommendation — Detect malicious JavaScript execution in web content and script delivery chains. Hunt for drive-by delivery and investigate compromised pages or advertising chains. Treat browser mining as resource hijacking and block the underlying delivery mechanism.
OWASP Non-Human Identity Top 10	NHI-03 — Secrets Exposure and Sprawl	Injected web scripts often rely on compromised service keys, tokens, or embedded dependencies.
	NHI-06 — Excessive Privilege	Third-party script or service trust can broaden what injected code can reach or do.
Recommendation — Reduce secret exposure in web delivery paths so hostile scripts cannot piggyback on trusted access. Restrict the privilege of web dependencies and embedded services to the minimum required.

Practitioner Guidance

What to watch for: Focus on abnormal JavaScript resource consumption, unexpected third-party script sources, and user complaints that cluster around specific pages or campaigns. A browser mining event is often easiest to confirm by comparing page load behaviour against known-good content and recent web changes.

Governance implication: Ownership should extend beyond the application team to include ad tech, analytics, tag management, and other embedded dependencies. If a site can load arbitrary third-party code, then the security boundary includes every script source that can reach the browser.

Browser Based Mining Script