Web browsing is the act of using a web browser to navigate websites and web applications on the internet or an internal network. It relies on HTTP or HTTPS requests, cookies, caching and scripts to retrieve and render pages, and it can expose session data, credentials and downloaded content to browser-based attacks or misconfigured sites.
What Web Browsing Actually Does
Web browsing is a request-response activity between the browser, the site, and the network stack. The browser fetches HTML, stylesheets, scripts, images and other resources, then interprets them in a local execution environment that can store state, execute code, and follow links across origins. That combination makes browsing much more than passive reading: it is an active client-side execution surface.
Because the browser is both a rendering engine and a policy enforcement point, its behaviour changes depending on cookies, storage, same-origin rules, content security policies, certificate validation and extension permissions. Small differences in browser settings or site behaviour can change what data is exposed, what code runs, and which actions a page can trigger.
Core Security Properties of Web Browsing
From a security perspective, browsing sits at the boundary between trusted local context and untrusted remote content. The browser must decide what to load, what to trust, and what to isolate. That means the primary protection goals are confidentiality of session data, integrity of the rendered page and scripts, and containment of untrusted code running in the tab or browser process.
Web browsing also creates implicit trust relationships. A site may appear benign while loading third-party scripts, advertising content, tracking pixels or embedded widgets that can influence page behaviour. Browser security therefore depends on origin isolation, safe handling of authentication material, and strong controls around script execution and downloads.
Common Browsing Attack Surfaces
The main attack surface is not the page itself but the interaction between the page and the browser. Phishing pages, malicious downloads, cross-site scripting, session theft, drive-by exploitation and browser extension abuse all rely on the fact that users browse to arbitrary content and the browser must process it quickly and automatically. Even a legitimate site can become dangerous if it is compromised or if it includes vulnerable third-party content.
Browser-based attacks often aim at the data already present in the browsing session. Cookies, bearer tokens, saved passwords, autofill data and cached content can be abused if a page gains execution it should not have, or if the user is tricked into granting access. The browser is therefore a high-value target because it concentrates identity state, application data and user trust in one place.
Safe Browsing Behaviour and Control Boundaries
Effective browsing security depends on understanding control boundaries, not just using a modern browser. Users and administrators need to distinguish between the browser, the website, the operating system and any extensions or endpoint controls that sit between them. A secure browser can still be undermined by risky downloads, permissive extension use, stale software or weak site hygiene.
Good browsing practice is about reducing exposure to untrusted code and preserving trust boundaries. That includes using reputable browsers, keeping them updated, limiting extensions, avoiding credential entry on suspicious sites, and treating browser prompts with caution. On managed endpoints, browser policy, DNS filtering and endpoint detection help reduce the blast radius when browsing goes wrong.
Risk and Threat Considerations
Web browsing is a frequent route into compromise because it places users in continuous contact with untrusted content while giving that content a powerful execution environment. The most common consequences are credential theft, session hijacking, malware delivery and covert redirection to fraudulent or malicious pages.
Failure mechanism: Attackers abuse trusted browser behaviour, such as script execution, redirects, cached credentials or user approval prompts, to steal data or execute malicious content inside the browsing session.
Impact: A compromised browsing session can expose account access, corporate data, internal applications and downstream systems that trust the browser or the user behind it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-17 — Remote Access | Browsers are a primary remote access path to web applications and internal resources. |
| IA-5 — Authenticator Management | Browsing exposes cookies, tokens and stored credentials that require lifecycle protection. | |
| SI-3 — Malicious Code Protection | Browsing is a common delivery path for malicious downloads and drive-by payloads. | |
| Recommendation — Restrict browser-based access paths to approved services and enforce session protections. Protect and rotate browser-accessed credentials, tokens and related authenticators. Scan downloads and block known malicious content delivered through the browser. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | This control family directly addresses browser exposure, phishing and malicious web content. |
| Recommendation — Harden browser protections and block risky web content to reduce user compromise. | ||
Practitioner Guidance
What to watch for: Treat browser security as both a user-behaviour issue and a platform-control issue. A browser that is “up to date” is not enough if extensions are over-permissioned, downloads are uncontrolled, or authentication flows are poorly protected.
Governance implication: Organisations should define approved browser configurations, extension standards and safe browsing expectations for managed devices, especially where users access sensitive applications or internal resources through the browser.
Practitioner takeaway: The safest browsing posture comes from combining user discipline with technical containment, because neither one is sufficient on its own.
Related resources from NHI Mgmt Group
- What breaks when browsing agents trust web content too much?
- When does consolidating legacy access and browsing tools make more sense than keeping VPN, VDI, and web gateway controls separate?
- How should teams prevent forced browsing from exposing restricted user data in web applications?
- Why can casual web browsing at work still create security risk for an organisation?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org