An employee clicks a box that says “verify you’re human.” A prompt tells them to press a couple of keys, so they do. What they have actually done is paste and run a command that a script slipped onto their clipboard the moment they clicked. Nothing downloaded. No attachment. No alert. In the span of a few seconds, a well-meaning user handed an attacker a live, logged-in session, and every security tool the company pays for watched it happen and saw nothing worth flagging.
This story illustrates where the fight happens now, and how little of our security is standing there. The attack never touched the network, the mail gateway, or the endpoint in any way those tools were built to notice. It happened inside the browser.
As defenders, we spent two decades learning to secure the endpoint. Then the work quietly moved off of it and into the browser tab, and most of our defenses stayed exactly where they were. The browser is now the most important application on every computer in the company, and the least governed one. Attackers figured that out before the rest of us did.
Everything moved into the tab
Ten years ago, the sensitive parts of a business lived in installed software and files on servers. That is the world our security tooling was built for. But that isn’t today’s reality.
Today the crown jewels are SaaS. Email is a browser tab. The CRM is a browser tab. Finance, HR, the file share, the source repository, the AI assistant someone signed up for last week: all of it renders inside a browser. The browser is where identity now lives, in the form of session tokens. It is where data flows all day. It is where the newest, least-governed tool in the environment is running right now.
When everything valuable concentrates in one place, that place becomes the target. Attackers are not sentimental about it. They go where the work is, and the work is in the browser.
The evidence is not subtle
This is not a prediction. The move already happened, and it shows up across a lot of independent reporting that, read together, points at one surface.
Start with raw exposure. Google shipped fixes for a run of actively exploited Chrome zero-days in the first half of this year, flaws attackers were using in the wild before a patch existed. Zoom out and the Verizon Data Breach Investigations Report found that exploiting a vulnerability overtook stolen credentials as the top way attackers get in. A large share of what an organization runs, all day, is a browser.
Then look at technique. Attackers increasingly don’t break in at all. In a social-engineering method Microsoft has analyzed under the name ClickFix, a web page shows a fake “verify you’re human” prompt and talks the user into pasting and running a command themselves. No attachment for the mail filter to catch, no download for the browser to flag. The victim is the delivery mechanism, and the browser is the stage.
Look at the prize. The thing attackers most want out of a compromised browser is usually not the password. It’s the session: the token that says this person already cleared MFA. Steal that and you inherit an authenticated session without touching the password or the second factor. An entire infostealer economy exists to harvest those tokens at scale, which is precisely why they are worth so much.
Look at the supply chain. Browser extensions run with sweeping access to everything you do on the web, and the official stores are not the safety net people assume. Attackers have phished extension developers and pushed malicious updates to tools users already trusted, and researchers have found large batches of malicious extensions inside the Chrome and Edge stores, some wearing the “verified” badge that is supposed to signal safety.
And, finally, look at what is arriving next. AI is moving into the browser itself, as extensions that read every page and as agentic browsers that take actions on the user’s behalf. That introduces a failure mode we have never had to defend before: a web page that hides instructions the AI obeys. Security researchers at Brave demonstrated exactly that against an agentic browser, getting it to pull a one-time passcode out of the user’s email from text buried in a page.
Six headlines, one surface. These are not six unrelated problems to be solved with six products. They are one problem disguised in different ways.
Why the stack doesn’t see any of it
Go back to the employee who pasted a command into their own machine and handed over a session. Why did nothing fire? Not because the tools failed, but because none of them were ever pointed at that moment.
Almost every control we rely on is built for a world where the browser is a window onto the internet, not the place the business lives, so each one sits around the browser and never inside the session. Network filtering watches traffic heading out to the internet, and this all rode inside normal, encrypted sessions to services the company uses every day. The endpoint agent watches processes and files, and a person running a command they were told to run, or an attacker replaying a stolen session from their own machine, reads as ordinary activity. The mail gateway watches the inbox, and a poisoned extension update or a booby-trapped page never passes through it. MFA guards the moment of login, and session theft happens comfortably after login, riding the token MFA already blessed.
The attacker isn't beating these controls. They are working in the space between them, in the one layer none of them were built to watch. That is why more of the same doesn’t help, because this is a category the stack was never designed to cover.
The browser is an endpoint you need to manage
The good news is that this is not an exotic new discipline. We already know how to secure an endpoint. We inventory it. We patch it. We set policy on what can run. We monitor it. We restrict who can install what.
We simply forgot to apply any of that to the browser, because for a long time we didn’t have to. It was a viewer. It fetched pages and threw them away. Now it’s a runtime, an identity store, and an application platform at the same time, and a lot of us are still governing it like a viewer, which is to say not at all.
The shift is conceptual before it is technical. Start treating the browser as managed infrastructure. Know which browsers and versions are running, so a zero-day is an inventory question and not a mystery. Know what extensions are installed and what they are allowed to read. Decide what a session is worth and protect it, which is finally getting easier as device-bound session credentials make a stolen cookie useless on any machine but the original. Decide, on purpose, what AI is allowed to touch. None of this is a new product category. It is the endpoint playbook, pointed at the layer we skipped.
The platform is starting to help on its own. Browsers now default cookies to safer settings, isolate sites from each other, and are rolling out device-bound sessions. That progress is real, but it isn’t a substitute for governance. The browser vendor can harden the tool. Only you can manage your environment.
Where this leaves you
Nothing about that opening scene required a sophisticated attacker. A person clicked a button, the way they click a hundred buttons a day, and the damage happened in the one place nobody was watching. You can’t train your way out of that. The click will always come.
The controls we have are not wrong. Network filtering, endpoint detection, and MFA all still matter, and nothing here says otherwise. But every one of them is aimed at the world as it was a decade ago, when the browser was the least interesting thing on the machine. The work moved. The attackers followed it. The defenses, for the most part, stayed exactly where they were. That distance, between where our tools point and where the work actually happens, is the gap the last few years of browser attacks have been quietly walking through.
Closing it will not come from a new box. It comes from a plainer admission: the browser is where the business runs now, and it is long past time we managed it accordingly.
