Browser Security

Threat Context

Insights from

The average organisation now runs over 100¹ web-based apps and staff access those apps through the browser, in sessions outside the view of security.

The increased exposure is visible; in FY2024-25, ASD reported 11% more cyber incidents while self-reported business losses rose 50%, with compromised accounts or credentials a factor in 42% of the most serious cases.² In APAC broadly, 69% of breaches across the region involved compromised creds.

Credential theft is fast becoming the goal of smaller scammers, who can sell the data to larger threat groups.

From session data to sold on the dark web

The browser is where attackers steal credentials and active session tokens. The dark web is where they profit. An IBM Study investigated a maturing ecosystem where stolen credentials were sold as a service.³

Session hijacking kits are also sold to exploit the browser. Attackers buy adversary-in-the-middle phishing kits⁴ to steal valid tokens. Once an attacker holds a valid session token, they inherit all that user's access without triggering any further authentication challenge.

What "stolen browser data" looks like in practice: In April 2026, an infostealer infection at a small AI productivity vendor cascaded into Vercel through an OAuth-permissioned Chrome extension a Vercel employee had installed at onboarding; ShinyHunters listed the resulting Vercel database for sale at USD $2 million.⁵ MFA at Vercel didn't block it because authentication was already complete. The attacker inherited an authorised browser session.

In Australia today, there's an estimated 25 million live access session tokens for sale on dark web marketplaces.

The unprecedented scale of AI-related exposure

Enabling staff with AI has become an urgent requirement for many businesses. Forcing IT teams to write policies that govern how AI is used safely in conjunction with work data.

And if they're not rushing to catch up, they still don't realise how exposed the data is.

More than half of all GenAI adoption is estimated to be without IT knowledge or approval.⁶ In Australia, 87% of organisations have staff accessing GenAI apps monthly.

As AI integrates further into our workflows the governance gets murkier. Attackers exploit the gap by cloning popular browser extensions for AI assistants. The same data-exfiltration behaviour is now showing up in legitimate, highly rated extensions whose vendors have quietly added it as a product feature. In January 2026, Similarweb (1M+ users) and Stayfocusd (600K+ users) were found scraping every ChatGPT, Claude, Gemini and Perplexity conversation their users had, with the change technically disclosed in updated terms users never read⁷. Two AITOPIA-clone extensions affected roughly 900,000 users, harvesting LLM transcripts every thirty minutes. Detection requires watching extension behaviour over time, not just at install.

Agentic AI is reshaping what "trust the browser" means

Agentic browsers (those that take actions on the user's behalf) read untrusted webpage content as if it were user instructions. A staff member asks the agent to summarise a Reddit thread; embedded text in a comment tells the agent to open Gmail and exfiltrate financial emails, and the agent silently obeys. There is no phishing click. There is no malware. The user is inside an authenticated session they initiated, with MFA already satisfied⁸.

This is not a single bug to patch. Brave Security disclosed the issue in August 2025 and a second wave of "unseeable" injection variants in October. LayerX disclosed CometJacking the same month… a single click hijacks an authenticated session to extract email, calendar and connector-granted data. Zenity Labs disclosed the PleaseFix family in March 2026, including calendar-invite triggered password manager takeover. Perplexity's patches were bypassed twice. OpenAI shipped ChatGPT Atlas with a "logged-out mode" as explicit acknowledgement that the problem has no clean technical fix.

Traditional security models assume a clean separation between "user instructions" and "untrusted content." Agentic browsers collapse it. Any agentic AI tool given access to authenticated sessions becomes a privileged insider whose decisions are influenced by content the user is viewing.

Product Landscape

Comparing browser security products is complex. Solutions overlap and differ in approach; browser extensions, enterprise browsers and cloud-hosted isolation platforms.

Tekspace's Cyber Continuum™ ranks 13 of the best browser security products in one transparent, measurable spectrum. We understood 400+ disparate features, normalising the marketing jargon or vendor framing to 40 capabilities, each ranked by its technical depth.

Addendum

Credits

In launching this report, the Tekspace would like to acknowledge contributions from the following teams and individuals.

References

1. Okta, Businesses at Work 2025, March 2025. Average 101 apps per organisation, 9% YoY growth.
2. ASD, ACSC Annual Cyber Threat Report 2024-25, October 2025. 1,253 incidents (11% increase); compromised accounts or credentials in 42% of C3 incidents; $80,850 avg business cost; $202,700 large org cost.
3. IBM, X-Force Threat Intelligence Index 2025, April 2025. 84% increase in infostealer delivery via phishing 2024 vs 2023; early 2025 data suggests ~180% jump over 2023.
4. Microsoft, Digital Defense Report 2025, November 2025. Token theft listed as key user impersonation tactic; AiTM phishing proxy interception of sessions.
5. Cyber Lab and Parabellum case file, April 2026. Vercel x Context.ai supply chain compromise: infostealer infection at a third-party AI vendor cascaded through an OAuth-permissioned Chrome extension into Vercel's Workspace; ShinyHunters listed the Vercel database for sale at USD $2M on BreachForums.
6. Netskope, Shadow AI and Agentic AI 2025, August 2025. Over half of all current genAI app adoption estimated to be shadow AI; avg 15 genAI apps per org.
7. Secure Annex (John Tuckner), January 2026; reported via TechCrunch and DarkReading.
8. Brave Security and LayerX, August - October 2025. Comet prompt injection and CometJacking disclosures: malicious page content executed as agent instructions; single-click hijack of an authenticated agentic browser session to extract email, calendar and connector data. Brave: “a systemic challenge facing the entire category of AI-powered browsers.”
9. CrowdStrike, Global Threat Report 2025, February 2025. 75% of initial access attempts malware-free; access broker advertisements surged 50% YoY.
10. Verizon, Data Breach Investigations Report 2025, May 2025. 46% of compromised systems with corporate logins were non-managed devices; only ~54% of edge device vulnerabilities fully remediated; edge device exploitation grew ~8x YoY.

Scope

This report evaluates browser-native edge security platforms delivering web threat prevention, browser-based data loss protection, SaaS access governance, and GenAI usage controls. It does not cover traditional network security products (SASE, SD-WAN, secure web gateways operating at the network layer), standalone endpoint detection and response platforms, or broader governance/risk/compliance tools. The evaluation methodology and vendor data are documented separately in the Tekspace Cyber Lab product landscape workbook.

Scoring Methodology

Features were classified into three maturity bands based on how many of the 13 evaluated vendors offer each capability across 40 normalised features. Comprehensive features (offered by the majority of vendors) represent table stakes. Broad features (moderate vendor coverage) represent strong market presence. Focused features (limited vendor coverage) represent specialist capabilities. A weighted scoring model assigns higher value to features that require greater technical depth, producing a single maturity score per vendor. Full scoring methodology is available on request.

Feature Granuality Model

At the outset, we aimed to produce an analysis that is both strategic and practical. It needs to be useful to all IT leaders, regardless of how familiar they are with a given product domain.

In doing so, we gave consideration to how products are compared against one another.

Comparison at a superficial level is too shallow and doesn't give insight as to differentiation between products. At the same time, diving into technical minutiae can often mean losing focus of how products are meaningfully differnt.

As such, we conduct our evaluation at what we call, Level 2: The Functional Group.

In doing so, we can consistently assess whether a product's capabilities are more or less likely to help IT leaders achieve their desired outcomes.

Disclaimers

Tekspace maintains commercial relationships with vendors across the cybersecurity industry. These relationships do not influence the research methodology, vendor scoring, or maturity tier placement documented in this report. All assessments reflect Tekspace's independent professional judgement based on hands-on product evaluation.

This report is intended as a decision-support tool and does not constitute professional advice. Organisations should conduct their own due diligence appropriate to their specific requirements, risk profile, and regulatory obligations.

If you believe any information in this report requires correction, or if you would like your product assessed for inclusion, contact the Tekspace Cyber Lab at lab@tekspace.com.au.