Why does browser-based cryptomining create risk for organisations that allow users to visit high-traffic or streaming sites?

Browser-based mining turns user sessions into an unapproved source of compute, which can degrade performance, increase power consumption, and mask malicious activity inside ordinary web traffic. It becomes especially risky when scripts run on compromised sites or on pages where users spend long periods, because the abuse can persist quietly while victims assume the site is functioning normally.

How browser-based cryptomining turns web traffic into a resource drain

Browser mining uses the visitor’s CPU or GPU while a page remains open, so the “cost” shifts from the site operator to the user’s device. That creates performance contention with the rest of the browser, raises power draw, and can make a busy site feel slow even when the page itself looks normal. On shared endpoints, the effect can spread into broader productivity loss.

For organisations, the issue is not only computation theft. High-traffic and streaming sites keep sessions active for long periods, which gives unwanted scripts more time to consume cycles, stay resident, and blend into ordinary page activity. The longer the session, the more likely a browser-based miner can create sustained user impact without obvious signs of compromise.

Why high-traffic and streaming environments make the abuse harder to notice

Sites with continuous media playback, long dwell times, or frequent refreshes create a favourable operating pattern for covert mining. Users already expect elevated device activity from video, ads, and scripts, so a miner can hide inside the same noisy baseline and avoid immediate suspicion. That makes detection harder for both users and defenders who rely on visible browser symptoms alone.

Compromised third-party scripts, injected content, or malicious ad delivery can also introduce mining code without changing the visible function of the page. Because the browser continues to render content normally, the abuse can persist while the organisation loses device performance, battery life, and some share of the endpoint’s available compute.

What makes browser mining an organisational risk rather than just a nuisance

The risk grows when the same behaviour affects many users at once. Even a modest per-session drain can become a material fleet-wide efficiency problem if lots of staff, kiosks, or VDI sessions spend time on the same compromised or ad-heavy properties. In that scenario, the organisation absorbs indirect cost in the form of slower devices, increased support burden, and reduced worker throughput.

The security concern is also about trust boundary abuse. A web page that appears legitimate may be repurposed to run code the user never approved, using the browser as the execution environment. That does not usually mean full system compromise, but it does mean attacker-controlled workload can ride on normal web access and remain difficult to separate from legitimate site behaviour.

Risk and Threat Considerations

Browser-based cryptomining is attractive because it can convert ordinary web visits into a low-friction abuse channel. The attacker does not need persistent host access; they need only enough script execution time to consume resources and stay hidden inside normal browsing activity.

Failure mechanism: Malicious or compromised web content runs mining code in the user’s browser, creating sustained CPU or GPU consumption that is difficult to distinguish from ordinary page processing.

Impact: Organisations can see degraded endpoint performance, higher energy usage, reduced user productivity, and weaker visibility into what code is actually executing inside trusted-looking sites.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1496 — Resource Hijacking	Browser mining is a form of compute abuse through victim resources.
Recommendation — Detect and block resource-hijacking behavior that consumes endpoint CPU or GPU.
NIST CSF 2.0	DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events	Continuous browser-side abuse is easiest to catch through monitoring of endpoints and traffic patterns.
Recommendation — Monitor endpoint and browser activity for sustained resource anomalies and suspicious script delivery.
CIS Controls v8	CIS-8 — Audit Log Management	Abusive script delivery and repeated execution require logs to investigate patterns and affected sites.
Recommendation — Centralize logs that show suspicious web activity, script loads, and unusual resource spikes.
OWASP ASVS	V4 — API and Web Service	The issue often rides on web-delivered code and third-party content paths.
Recommendation — Review web-delivered dependencies and restrict untrusted script execution paths.

Practitioner Guidance

What to prioritise: Focus first on the sites and delivery paths that combine long dwell time with third-party script exposure, because those are the conditions where browser mining is most likely to persist unnoticed. If the same property is also allowed on managed endpoints and kiosk-style devices, treat it as a higher operational exposure.

What to verify: Confirm whether performance complaints correlate with specific domains, ad networks, or embedded scripts, and check whether browser CPU spikes continue when page content appears idle. If a site’s normal business function does not justify sustained compute load, investigate the script chain rather than assuming the device is simply underpowered.

Practitioner takeaway: The practical problem is not that a miner can always “take over” a machine, but that it can quietly tax many devices through normal browsing paths, so visibility into script behaviour and site trust is more important than relying on user complaints alone.