2026年浏览器安全状况报告

Contents Foreword Introduction Methodology Security challenges 1. Gen AI 2. Browser DLP 3. Browser-based attacks 4. Extension management 5. AI browsers and browser sprawl Future outlook Appendix About Keep Aware Foreword Over the past few years, the browser has become the mostimportant enterprise endpoint. Work no longer happens within thecorporate network or even traditional applications. It happens intabs. In AI copilots and GenAI applications. In SaaS. And in desktop At the same time, the security market signaled something important.We saw major acquisitions across SASE and EDR. Entire categoriesare colliding in an effort to regain visibility and control over howwork actually happens. These acquisitions are not just Neither network controls nor traditional endpoint agents weredesigned for a world where business logic executes inside thebrowser. Neither has the native context to understand user actions 2025 also saw the rapid rise of AI‑native browsers and AI‑embeddedapplications. Browsers are no longer passive renderers of webpages: they are agents, assistants, automation engines, and data transmit sensitive information at machine speed, and can actautonomously. That shift fundamentally changes the risk model:security teams are no longer just defending users in the browser, The events of the past year make one thing clear: the browsercannot remain an extension of network policy or an afterthought ofendpoint protection. It needs to stand on its own, with its own Security teams must be able to understand: •What data is being accessed, generated, or pasted into AI tools•What SaaS applications are being used and how•What actions users and AI agents are taking in real time Without a browser-native model, organizations are blind to the verylayer where productivity and risk now converge. Understanding thestate of browser security starts with understanding the state of the The future of work runs in the browser. The future of AI runs in the browser. Security must meet it there. Introduction Industry data and security teams' firsthand experience in the lastyear confirmed a fundamental shift: the browser is now the primary As network and email security matured, these threats shifted to"known good" environments: legitimate browsers, trusted SaaS, andauthenticated sessions. Unlike email, where organizations controlflow and inspection, browser activity is inherently fragmented This browser blind spot exposes areas of risk across the entirebusiness. Credential theft, session hijacking, and data exfiltrationnow occur through everyday work (file uploads, SaaS logins,embedded third-party tools) without triggering traditional Verizonʼs 2025 DBIRechoed this: the human element is involved in60% of breaches. Industry analysts like Gartner have similarly calledout the browser as a critical yet under protected control point.Gartner predicts that by 2028, 25% of organizations will deploy a The research in this reportvalidates what IT and securityteams across industries havelong suspected:traditional Methodology This report is based on anonymized telemetry collected fromproduction enterprise environments using the Keep Aware browsersecurity platform. The analysis reflects real-world browser activityobserved over a twelve-month period, with select metrics derived Definitions and Classification •Sensitive dataincludes structured and unstructured contentmatching enterprise policy definitions, such as PII, PHI, financial •Corporate accountsare identities federated or governed byenterprise identity providers, or account domains validated to •Personal accountsare identities not managed by enterpriseSSO or identity infrastructure. In many cases, both were used •Confirmed phishingreflects in-session credential harvesting ordeceptive login flows observed through user interaction. •Extension riskis determined based on permission scope,reputation signals and organizational context, behavioral Security Challenges As work continues to consolidate inside the browser, so do theenterpriseʼs most pressing security challenges.Generative AItoolsare now embedded in everyday workflows, introducing new dataexposure risks that demand real-time monitoring and governance.Sensitive information is routinely typed, pasted, and uploaded into SaaS applications, makingBrowser DLPessential for visibility where data actually moves. At the same time, attackers increasingly operate through browser-native techniques—phishing, OAuth abuse,malicious extensions, and social engineering—driving the need for 1. Gen-AI Monitoring Challenges in Generative AI has rapidly become embedded in daily workflows,with the browser serving as the primary interface for interaction.While these tools deliver productivity gains, they also introduce new Our 2025 data shows that GenAI adoption is already widespread,unevenly managed, and frequently intertwined with sensitive Widespread GenAI Adoption Is Fragmented AcrossPersonal and Corporate