6 MIN READ
For most office workers in 2026, the browser runs as the operating system. The applications you spend your day in are web apps, the files live in cloud storage, the meetings happen in a video tab, the shared documents are web apps. The operating system underneath has become a thin layer of plumbing that boots the runtime and connects to the network, and the security model that came with it was designed for a world where this surface was a document viewer rather than the place where the work happens.
The gap between the model and the reality is most of the attack surface. The web runtime in 2026 carries credentials, sessions, sensitive documents, payment flows, and access tokens for the applications the rest of the business actually depends on. The security model behind it dates to 2009, when the browser was a thin client that fetched HTML and ran a few scripts. Three primitives defined that model, and they have aged unevenly.
Three primitives, one of which has failed
Same origin policy. Scripts from one origin cannot read data from another origin. This has held up. The caveats are well understood (cross origin resource sharing, postMessage, the long tail of subtle bypasses), and the primitive is the right one for the architecture it was designed for.
The sandbox. Untrusted code runs in a restricted environment without access to the operating system. The sandbox is a real defence, and the modern runtime is dramatically more secure against drive by exploitation than the surface of 2010 was.
The user. You are expected to make sensible decisions about which sites to trust, which permissions to grant, and which prompts to accept. This primitive has not scaled. People are asked to make dozens of these decisions a day, in conditions designed to wear them down (fatigue, distraction, the genuine need to get work done), against attackers who have learned to mimic legitimate prompts with high fidelity. The user, as a security primitive, is broken.
What the credential manager is not telling you
The built in password manager, in Chrome, Safari, Firefox, and Edge, sits as the most common credential storage on the planet. In 2026 it is also the least secure password manager you can reasonably use, because the autofill has become the credential capture vector.
A malicious extension, a malicious advert, a malicious script on a compromised legitimate site: any of these can request the stored credentials for the current origin, and the surface will offer to autofill them. You click yes because you are in a hurry and the prompt looks like a helpful feature. The credentials go to the attacker, who logs in as you. You do not know until the breach disclosure arrives months later.
This stands as the single most common initial access vector in the breaches that get disclosed, and the vendors have known about it for years. The mitigation they have shipped amounts to another user prompt, which is the primitive that has not scaled.
What the session model is not telling you
Once you are logged in, the session lives in a cookie or a token. That token is what carries your identity to the application on every request. A stolen session is as good as a stolen password, and the session is more vulnerable because you are not trained to protect it.
Session theft has replaced password theft as the dominant post credential access vector. A malicious extension or a script on a compromised site reads the cookie via a same site loophole, or malware on the endpoint scrapes the session storage and exfiltrates it. The application sees a valid session from a valid user, and the breach begins.
The mitigations (short lived sessions, device binding, continuous authentication) are real. None of them are free, and none of them are what the average enterprise has shipped.
What the extension model is not telling you
Extensions run with the permissions you granted at install time, and those permissions do not shrink when the extension is sold to a new owner, when it is compromised through a supply chain attack, or when its stated purpose drifts away from its actual behaviour.
There have been a dozen high profile incidents in the last three years where a popular extension was acquired by an entity that turned it into a data exfiltration tool. The DataSpii incident in 2018 was the early example. The Honey/Paypal controversy in 2024 was the consumer example. The pattern repeats because the extension marketplace does not vet the new owner, and the runtime does not re prompt for permissions on ownership change.
For the enterprise, the mitigation is a managed extension allowlist, and most have not built one. Periodic review of what extensions are actually doing is a research project nobody has the hours for.
What to do about it
The platforms that are taking this seriously have moved past treating the runtime as an endpoint. They treat it as a managed application surface. The shape of the work looks like this.
Move credential storage to a dedicated enterprise password manager. The built in manager stays disabled by policy. The autofill vector goes away.
Move session handling to short lived tokens with device binding, and require step up authentication for sensitive operations. A stolen session has a half life of minutes, not days.
Treat extensions as third party software. Maintain an allowlist, review ownership changes, monitor for behaviour drift. An extension is software running with your identity, so treat it the way you would treat any other third party binary.
Consider a managed enterprise runtime for the highest risk users. Island, Menlo, Authentic8, and the open source equivalents give the platform the visibility and control that the consumer surface does not. The cost is per seat and it is real, but it is cheaper than the breach.
Closing the gap between the 2026 runtime and a sixteen year old security model will take the next three years. Most of it amounts to the boring work of replacing primitives that have not scaled with primitives that have.
The bottom line
Dedicated password manager, short lived sessions, managed extensions, enterprise runtime for the high risk seats. The browser is the operating system now, and the security model it shipped with is sixteen years old. The defender who treats the runtime as a managed application surface is the one who will not be explaining a credential capture in the next breach disclosure.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
