A browser-borne attack is an intrusion that uses the web browser as the delivery point, control channel, or execution path for malicious activity. Technically, it exploits browser features, extensions, sessions, or trusted web content to steal data, hijack identities, trigger unauthorized requests, or move into connected systems.
How browser-borne attacks work
Browser-borne attacks abuse the browser as more than a viewing tool. The browser can become the place where malicious code runs, where a user is steered into unsafe action, or where a trusted session is hijacked without the victim noticing.
That matters because browsers sit at the junction of identity, web content, downloads, extensions, and cloud applications. A compromise in one tab or extension can reach passwords, session cookies, SSO tokens, and internal web apps, which makes the browser a high-value attack surface even when endpoint software is otherwise up to date.
Common delivery and execution paths
Attackers often use trusted-looking web pages, malicious ads, credential prompts, drive-by downloads, or browser extensions to begin the intrusion. Once the browser is abused, the attacker may not need to install a traditional payload immediately, because the browser itself can be used to collect data or proxy actions through the victim’s own authenticated session.
Extension abuse is especially effective because extensions can interact with page content, alter requests, and observe data that users assume stays private. For that reason, enterprise browser and browser security guidance is often more relevant than generic endpoint hardening alone when the goal is to reduce browser-level abuse.
Why browser-borne attacks are dangerous
These attacks are dangerous because they blend into normal user activity. The traffic may look like ordinary browsing, the user may appear to be logged in legitimately, and the malicious step may happen inside a familiar browser interface rather than through a suspicious executable.
That creates several consequences: data theft from web apps, silent session takeover, unauthorized form submission, and lateral movement into connected systems that trust the browser session. When the browser becomes the delivery point for phishing or lookalike login flows, phishing tradecraft often becomes the entry mechanism for the larger browser-borne intrusion.
Defensive focus areas
Browser-borne attacks are best reduced through layered controls around browser policy, extension governance, session protection, and identity hygiene. Organisations should pay particular attention to browser telemetry, managed extension allowlists, download controls, and the security of saved credentials and session data.
The main defensive question is not only whether a browser is patched, but whether it is constrained enough to prevent a browser from becoming a general-purpose execution and exfiltration environment. For broader incident context and attacker patterns involving stolen credentials, compromised sessions, and chained access, The State of NHI & AI Agent Breach Report 2026 provides useful breach-level perspective.
Risk and Threat Considerations
Browser-borne attacks are especially risky because they exploit trusted browser state, not just malicious files. That makes them effective against environments that rely heavily on web apps, SSO, and browser-resident credentials, and it can leave defenders with little obvious malware to investigate.
Failure mechanism: The browser is tricked into loading malicious content, handling unsafe extension behaviour, or reusing an authenticated session in a way that exposes data or triggers unauthorised actions.
Impact: Attackers can steal credentials or session material, impersonate users, access internal web systems, and extend compromise into connected services that trust the browser session.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Browser-borne attacks abuse browser sessions and credentials that need controlled account handling. |
| Recommendation — Restrict browser-based access paths and review account exposure tied to web sessions. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Browser-borne attacks often abuse stored credentials, tokens, and session material. |
| AC-6 — Least Privilege | Browser abuse succeeds more easily when web sessions and extensions have excessive access. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detection of browser abuse depends on reviewing browser, identity, and web access activity. | |
| Recommendation — Manage and rotate browser-exposed authenticators and session-bearing credentials. Limit browser-driven access and reduce privilege available through web sessions. Review browser and web access logs for anomalous session and extension activity. | ||
| OWASP ASVS | V7 — Session Management | Browser-borne attacks frequently hijack or replay browser sessions. |
| V8 — Authorization | Browser-based compromise often turns into unauthorised actions inside web applications. | |
| V16 — Security Logging and Error Handling | Browser-borne intrusions require evidence from login, session, and client-side activity logs. | |
| Recommendation — Strengthen session handling to reduce hijack and replay risk in browsers. Verify authorization checks so browser compromise cannot escalate web app actions. Log browser and web security events so suspicious session behaviour can be investigated. | ||
| MITRE ATT&CK | T1566 — Phishing | Phishing is a common browser delivery path for malicious content and credential capture. |
| T1185 — Browser Session Hijacking | Browser-borne attacks can directly abuse active browser sessions and trusted web state. | |
| Recommendation — Map browser-delivered phishing activity to T1566 and tune detection accordingly. Hunt for stolen browser sessions and investigate unexpected reuse of authenticated web access. | ||
Practitioner Guidance
What to watch for: Treat browser settings, extension inventory, and session behaviour as security controls, not just user preferences. A sudden new extension, repeated credential prompts, unusual browser redirects, or unexplained browser data access can be early indicators of abuse.
Practitioner note: The most effective response is usually to reduce what the browser is allowed to trust by default. Tight extension control, safer sign-in flows, and stronger inspection of browser activity will do more than relying on user caution alone.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org