A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
Improving the trustworthiness of Javascript on the Web
Today, there's no way to audit a site’s client-side code as it changes, making it hard to trust sites that use cryptography. We preview a specification we coauthored that adds auditability to the web.
Cross-Origin Read Blocking (CORB)
This document outlines Cross-Origin Read Blocking (CORB), an algorithm by which dubious cross-origin resource loads may be identified and blocked by web browsers before they reach the web page. CORB reduces the risk of leaking sensitive data by keeping it further from cross-origin web pages. In most browsers, it keeps such data out of untrusted script execution contexts. In browsers with Site Isolation, it can keep such data out of untrusted renderer processes entirely, helping even against side channel attacks.
Running Interactive Scripts | Web Browser Engineering
The first web applications were like the previous chapter’s guest book, with the server generating new web pages for every user action. But in the early 2000s, JavaScript-enhanced web applications, which can update pages dynamically and respond immediately to user actions, took their place. Let’s add support for this key web technology to our browser.
Embedding The Web
We need to talk more The web is much more than browsers. What works great in browser development is missing in related spaces like embedding. Can we get together to collectively describe security and compatibility properties of user agents that are not browsers? Can we develop things that don’t ...
Introducing WEBCAT: Web-based Code Assurance and Transparency
In this post, we introduce Web-based Code Assurance and Transparency, a project that supports verifiable in-browser code for single-page browser applications. Along with this post, we are publishing the WEBCAT project repository; follow-up posts will provide more detailed information.
Reducing XSS by way of Automatic Context-Aware Escaping in Template Systems
Posted by Jad S. Boutros, Security Team Building on our earlier posts on defenses against web application flaws [ "Automating Web Applicatio...
Keeping Data Private | Web Browser Engineering
Our browser has grown up and now runs (small) web applications. With one final step—user identity via cookies—it will be able to run all sorts of personalized online services. But capability demands responsibility: our browser must now secure cookies against adversaries interested in stealing them. Luckily, browsers have sophisticated systems for controlling access to cookies and preventing their misuse.
Protocol Handler Registration via Browser Extensions – make everything intensely
Custom URL schemes have traditionally served as an integration bridge between the browser and external capabilities. Schemes such as mailto: and tel: allow navigation to trigger actions beyond ordinary HTTP resource retrieval. The HTML Standard formalizes this mechanism through the Custom Scheme Handlers API, which enables websites to register themselves as handlers for specific URL schemes.
Making Content Accessible | Web Browser Engineering
So far, we’ve focused on making the browser an effective platform for developing web applications. But ultimately, the browser is a user agent. That means it should assist the user in whatever way it can to access and use web applications. Browsers therefore offer a range of accessibility features that take advantage of declarative UI and the flexibility of HTML and CSS to make it possible to interact with web pages by touch, keyboard, or voice.
Launch HN: Browser Use (YC W25) – open-source web agents | Hacker News
Check out this video to see it in action: https://preview.screen.studio/share/r1h4DuAk. There are lots more demos at https://github.com/browser-use/browser-use on how we control the web with prompts.
Intent to Prototype: Script Tools API
Script Tools enable authors to expose JavaScript APIs on their site for automated use by the user agent. They allow an author to annotate these APIs with descriptions and provide input schema, allowing automation frameworks a more specific method to access the site's functionality.
What is it? - NoScript: consensual browsing!
The NoScript Security Suite is Free Software protecting Firefox (on Android, too!), Chrome, Edge, Brave and other web browsers. Install NoScript now!
RFC: plyr.fm JavaScript SDK & Embeddable Web Components - Nate Spilman
Authors: Nate Spilman, Claude 4.6 OpusStatus: DraftDate: 2026-03-151. SummaryThis RFC proposes a JavaScript/TypeScript package that provides:Headless SDK — t...
Document: requestStorageAccess() method - Web APIs | MDN
The requestStorageAccess() method of the Document interface allows content loaded in a third-party context (i.e., embedded in an <iframe>) to request access to third-party cookies and unpartitioned state. This is relevant to user agents that, by default, block access to third-party, unpartitioned cookies to improve privacy (e.g., to prevent tracking), and is part of the Storage Access API.
Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet | Brave
The attack we developed shows that traditional Web security assumptions don't hold for agentic AI, and that we need new security and privacy architectures for agentic browsing.
