A browser is the client-side software that turns a web application’s HTML, CSS, JavaScript, and media into an interactive page. It runs on computers, phones, tablets, and increasingly embedded devices. For web security, it matters because it routinely receives code and resources from the internet, then decides what they may do on a user’s device. section 2.1 section 6.0
Its rendering engine processes HTML, loads referenced resources, applies styling and layout, and updates the screen as a user interacts with a page. To make those updates efficient, the engine builds a Document Object Model (DOM), an internal representation of page structure. Browsers also tolerate malformed HTML and missing or slow resources, making best-effort decisions about what to display. section 2.1
Alongside rendering, a JavaScript engine executes scripts embedded in or imported by a page. JavaScript-heavy single-page applications can edit the DOM directly for client-side rendering rather than generating interim HTML. Because that code may be loaded from the internet, the browser imposes limitations on what scripts can do. section 2.1 section 6.0
Browser security is central because browsers handle sensitive user activity while executing untrusted code:
- Users may make payments, view medical or financial information, and sign legal documents through a browser. section 6.0
- Attackers commonly target users’ browsers, including by trying to inject malicious JavaScript into pages they view. section 6.0
- Scripts cannot access arbitrary disk locations, though controlled forms of disk access exist. section 2.7
Treat the browser as an active security boundary, not merely a display surface. Its restrictions help protect the user’s computer, but applications still need to protect users from browser-delivered attacks. A failure to do so primarily harms users rather than directly attacking the application server. section 2.0 section 6.0
