Browser cryptocurrency mining is the use of a website or web page to run code in a visitor’s browser that consumes processing power to mine digital currency. Technically, it relies on JavaScript or similar scripts that turn endpoint CPU and battery into unauthorized compute, creating performance, security, and governance risks.
What Browser Cryptocurrency Mining Is Used for and Why It Matters
Browser cryptocurrency mining is a misuse of the web runtime, not a normal browser feature. It turns a visitor’s device into an unwitting compute source, which can degrade performance, drain battery, and create an abuse path that is hard to distinguish from ordinary script execution.
Because the activity happens inside a browser session, defenders often see only heavy client-side resource use rather than a clearly malicious executable. That makes the subject relevant to web security, endpoint performance, and abuse monitoring at the same time.
How Browser Mining Works in Practice
The mechanism is usually simple: a page loads JavaScript or similar code that repeatedly performs mining work in the background. The code may run after a page is opened, through an embedded widget, or as part of a compromised third-party script supply chain.
The security significance is the trust boundary it crosses. A user expects a web page to render content, not consume sustained CPU cycles for someone else’s gain. If the mining script is injected through advertising, tag management, or another dependency, the abuse can spread without the site owner fully noticing.
In some cases, browser mining is short-lived nuisance abuse. In others, it becomes a persistence mechanism for monetisation, especially where the script is reloaded from a remote endpoint or hidden behind obfuscation.
Security Implications for Users and Organisations
For users, the most immediate impact is resource exhaustion: slow browsing, device heat, battery drain, and reduced responsiveness. For organisations, the issue can also signal broader web compromise, because the same injection path that delivers mining code can deliver phishing, credential theft, or further script-based abuse.
Browser mining can also create governance problems. A site that allows opaque third-party scripts may be exposing visitors to unwanted compute consumption while failing to maintain a clear inventory of externally loaded code. That makes browser mining a good example of why client-side trust needs active review, not just server-side hardening.
When mining is delivered through a compromised website or embedded dependency, the incident is often less about cryptocurrency itself and more about control over browser execution, script provenance, and visibility into what the page is actually doing.
Detection and Containment
Detection usually starts with symptom correlation: sustained high CPU use, fans spinning, battery loss, or unusually slow page rendering that appears only on specific sites. On the network side, defenders may also look for repeated script retrievals, unusual WebSocket or long-polling behaviour, and suspicious third-party JavaScript sources.
Containment is often straightforward once the source is known: block the site or script, remove the injected code, and review which third-party assets were allowed to execute in the browser. For organisations, browser isolation, content security policy tuning, and script allowlisting can reduce exposure when a site must remain available.
Post-incident review should confirm whether the page merely mined cryptocurrency or whether the same delivery path also touched sessions, tokens, or other sensitive browser state. That distinction matters because browser mining can be a symptom of broader compromise rather than a standalone nuisance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1057 — Process Discovery | Browser mining often shows up through abnormal host resource use and process behavior |
| Recommendation — Correlate unusual browser CPU patterns with runtime activity to detect client-side abuse. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Browser-delivered mining abuse is a browser security exposure addressed by web protections |
| Recommendation — Harden browser controls and restrict risky web content to reduce script-based abuse exposure. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-Rest is Protected | Client-side abuse can involve browser-stored session material and local data exposure |
| Recommendation — Protect sensitive browser data and limit what web content can access in the client runtime. | ||
Practitioner Guidance
What to watch for: Treat unexpected client-side compute spikes as a security signal, not just a performance complaint. If a site is the source, check whether the mining code arrived through a compromised script, a third-party widget, or an injected page element.
Governance implication: Owners of web properties should know which scripts run in the browser, why they are present, and what they are allowed to do. The practical question is not only whether mining is happening, but whether the page has unnecessary trust in external client-side code.
Practitioner takeaway: Browser mining is often the visible symptom of a deeper web trust failure, so the right response is to investigate script provenance and browser-delivered dependencies, not only to stop the CPU drain.
Related resources from NHI Mgmt Group
- What are the signs that a browser is being used for hidden cryptocurrency mining?
- Why does an unsecured Docker daemon create a broader attack risk than simple cryptocurrency mining abuse?
- Why does cryptocurrency mining on an EC2 instance usually indicate broader cloud security risk?
- What should security teams do first when a cloud host is flagged for cryptocurrency mining activity?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org