Web Browsers as Operating Systems

On a traditional desktop, the security boundary was the device. In a SaaS-first company the valuable thing is not on the device at all. It is the session token in the browser's cookie store, which grants the same access as password plus MFA, often for days.

The latest data backs this up. The Verizon 2026 Data Breach Investigations Report found that vulnerability exploitation overtook stolen credentials as the top initial access vector for the first time, at 31%. The full report adds that credential abuse still appears somewhere in 39% of breaches, and that third parties are involved in 48%. The full DBIR also found that 67% of users access AI services on corporate devices with non-corporate accounts, which is almost always a browser tab.

IBM's 2026 Cost of a Data Breach study puts the global average breach at $4.99 million, a figure skewed by large enterprises.

MITRE tracks this as Steal Web Session Cookie (T1539). There are three routes we see in practice.

Commodity malware, usually delivered through fake downloads, cracked tools or malicious ads, copies saved passwords and session cookies from every browser profile on the machine. The logs are sold in bulk. Verizon notes that ransomware operators increasingly buy this harvested access rather than breaking in themselves. The infected device is rarely a managed laptop. It is a contractor's machine or a personal laptop someone used "just once" for work.

A phishing page proxies the real login page, the user completes MFA, and the attacker keeps the resulting session cookie. App-based push and SMS codes do not stop this. Phishing-resistant authentication does, because a passkey or security key will not sign a login for the wrong domain. CISA's fact sheet on phishing-resistant MFA is blunt: FIDO/WebAuthn is the only widely available phishing-resistant option. Our phishing scams guide covers the reporting habits that go with it.

An extension with permission to "read and change all your data on all websites" can lift cookies and page content from every tab. In late December 2024, attackers phished the developers of dozens of Chrome extensions, including one published by a security company, and pushed malicious updates through the official store. MITRE lists this under Browser Extensions (T1176.001).

One encouraging change: in April 2026 Chrome on Windows made Device Bound Session Credentials generally available, tying a session to a key that cannot leave the machine. It only protects sites that adopt it, so plan as if most of your stack has not.

This is the newest version of the extension problem. AI sidebars and summarizers read the full page you are on, including the customer record or the contract, and send it to a model. Agentic browsers go further: they click, fill forms and navigate while logged in as you.

Two risks follow. First, data leaves through a channel nobody approved, which is classic shadow AI. Second, the page can talk back. OWASP's LLM01:2025 Prompt Injection describes indirect prompt injection, where instructions hidden in a web page or file are obeyed by the model even though the human never sees them. An agent with your session and a poisoned page is an attacker with your session. IBM's 2026 study found 92% of organizations that had an AI-related breach lacked proper AI access controls.

Our position: allow AI assistants only through approved, company-account tools, and keep agentic browsing out of admin consoles and finance. Our guide to securing AI agents covers the permission model.

Vendors will tell you the answer is a new browser. Sometimes it is. Usually it is the browser you already run, with policies you have not switched on yet.

None of these replaces identity controls. A locked-down browser still hands over a valid session if the user approves a push prompt on a phishing page.

Thin clients make sense when the device itself cannot be trusted. In our experience that means four situations: contractors who need production data; shared frontline workstations such as support centers; roles handling regulated data such as health records under HIPAA or sensitive information under Quebec Law 25; and short-term staff where shipping laptops is impractical.

They make less sense for engineers and anyone who needs local compute, and they do not remove the need for a managed endpoint underneath. Our endpoint security guide covers that layer.

If you want a second pair of eyes, our Cybersecurity Baseline Assessment checks these controls against your actual stack. For ongoing ownership, a virtual CISO engagement starts from $2,000 a month; tiers are on our pricing page.

Technically no; it still runs on Windows, macOS, ChromeOS or Linux. Practically, it is where the work, the data and the sessions live, so it deserves the attention the operating system used to get.

Not by itself. Session theft happens after MFA is completed. Phishing-resistant MFA blocks the phishing route; short sessions and fast revocation limit the infostealer route.

It depends on what the attacker accessed. In Canada, PIPEDA requires reporting to the Office of the Privacy Commissioner when a breach creates a real risk of significant harm, and Quebec Law 25 has its own regime. In the US, every state has a breach notification law, and HIPAA applies if health data was exposed. Our data security and privacy team handles this assessment.

With the Canadian Centre for Cyber Security's web browser security overview: standardize on one browser, keep the number of extensions small, review permissions and avoid saving passwords in the browser. Then work through the 30-day list above, or book a call and we will walk through it with you.