{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/web-browser","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/web-browser/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/web-browser/"},"term":{"en":"Web browser","da":"Webbrowser"},"aka":{"en":["browser"],"da":["browser"]},"domain":["cs"],"cluster":"web","layer":"application","status":"current","era":1990,"summary":{"en":"The program people use to visit websites - it fetches pages from servers and turns them into something you can read and click.","da":"Programmet, man bruger til at besøge websteder - det henter sider fra servere og gør dem til noget, man kan læse og klikke på."},"body":{"formal":{"en":"A client program that requests resources over HTTP or HTTPS, draws the returned pages on screen, runs the code they contain in a closed-off space, and stores cookies and other data for each website separately.","da":"Et klientprogram, der henter ressourcer over HTTP eller HTTPS, tegner de modtagne sider på skærmen, kører den kode, de indeholder, i et lukket rum og gemmer cookies og andre data adskilt for hvert websted."},"plain":{"en":"Like a television set for the web - the shows are made and sent elsewhere, and the set just tunes in and plays them for you.","da":"Som et fjernsyn til nettet - programmerne laves og sendes et andet sted fra, og apparatet stiller bare ind og viser dem for dig."},"inPractice":{"en":"A finance clerk in a municipality opens the finance system, the online bank and a news site in three tabs of the same browser, and each site sees only its own data.","da":"En økonomimedarbejder i en kommune åbner økonomisystemet, netbanken og en nyhedsside i tre faner i samme browser, og hvert websted ser kun sine egne data."},"whyItMatters":{"en":"For most people the browser is the front door to their work, money and private life, so an out-of-date browser or a harmful add-on puts all of it at risk.","da":"For de fleste er browseren hoveddøren til arbejde, økonomi og privatliv, så en forældet browser eller en skadelig udvidelse sætter det hele på spil."}},"deepDive":{"en":"The first browser, WorldWideWeb, was written by Tim Berners-Lee in 1990; NCSA Mosaic (1993) brought inline images and mass adoption. Today three engine lineages remain: Blink with the V8 JavaScript engine (Chromium, and therefore Chrome, Edge, Opera, Brave and others; forked from WebKit in 2013), Gecko with SpiderMonkey (Firefox) and WebKit with JavaScriptCore (Safari, and on iOS historically every browser). Engine concentration matters for security: a flaw in Blink or V8 affects most of the desktop market at once.\n\nModern browsers are multi-process systems. A privileged browser process handles the UI, storage and network (in Chromium a separate network service), while web content runs in renderer processes confined by an OS sandbox (seccomp-bpf and namespaces on Linux, restricted tokens and job objects on Windows), with GPU work in its own process. Since Chrome 67 (2018), site isolation places different sites in different renderer processes so a compromised renderer or a Spectre-style side channel cannot read another site's data. Full remote compromise therefore usually requires a chain: a renderer bug, very often type confusion or use-after-free in the JIT-compiling JavaScript engine, plus a separate sandbox escape. Short release cycles (Chrome every four weeks, Firefox similarly) and silent auto-update exist to shrink the window between patch and exploitation.\n\nLoading a page follows a well-defined pipeline: DNS resolution, TCP or QUIC connection, TLS handshake with certificate path validation and, in Chrome and Safari, Certificate Transparency enforcement, then the HTTP exchange; the HTML parser builds the DOM, CSS becomes the CSSOM, and style calculation, layout, paint and compositing produce pixels. Scripts run on a single event loop per agent, as defined by the HTML Standard, and parser-blocking scripts delay rendering unless marked async or defer.\n\nBrowsers enforce most of the web's security model on the user's behalf: the same-origin policy and CORS, cookie scoping and SameSite, storage partitioning by top-level site, mixed-content blocking, HSTS including a preload list compiled into the binary, CSP and permission prompts for camera, location and similar capabilities. Extensions are the notable weak point, since they can hold broad host permissions across all sites; Chromium's Manifest V3 narrowed some capabilities, but malicious or hijacked extensions remain a route to session theft. In organisations, browsers are managed through policy (Group Policy or MDM), with extension allowlists, forced updates and restricted password saving. A browser is a specialised HTTP client, distinct from the web application it displays and from embedded web views inside native apps, which often lack the full browser's update cadence and protections.","da":"Den første browser, WorldWideWeb, blev skrevet af Tim Berners-Lee i 1990; NCSA Mosaic (1993) bragte billeder i teksten og massegennembrud. I dag er der tre motorlinjer tilbage: Blink med JavaScript-motoren V8 (Chromium og dermed Chrome, Edge, Opera, Brave og andre; forket fra WebKit i 2013), Gecko med SpiderMonkey (Firefox) og WebKit med JavaScriptCore (Safari og på iOS historisk alle browsere). Koncentrationen af motorer har sikkerhedsbetydning: en fejl i Blink eller V8 rammer det meste af desktopmarkedet på én gang.\n\nModerne browsere er systemer af flere processer. En privilegeret browserproces håndterer brugerflade, lager og netværk (i Chromium en separat network service), mens webindhold kører i renderer-processer, der er indespærret i en sandbox i styresystemet (seccomp-bpf og namespaces på Linux, begrænsede tokens og job objects på Windows), og GPU-arbejde kører i sin egen proces. Siden Chrome 67 (2018) placerer site isolation forskellige sites i forskellige renderer-processer, så en kompromitteret renderer eller en sidekanal af Spectre-typen ikke kan læse et andet sites data. Fuld fjernkompromittering kræver derfor som regel en kæde: en fejl i rendereren, meget ofte type confusion eller use-after-free i den JIT-kompilerende JavaScript-motor, plus et separat udbrud fra sandboxen. Korte udgivelsescyklusser (Chrome hver fjerde uge, Firefox tilsvarende) og automatisk opdatering i baggrunden skal mindske vinduet mellem patch og udnyttelse.\n\nIndlæsning af en side følger en veldefineret kæde: DNS-opslag, TCP- eller QUIC-forbindelse, TLS-handshake med validering af certifikatkæden og, i Chrome og Safari, håndhævelse af Certificate Transparency, derefter HTTP-udvekslingen; HTML-parseren bygger DOM'en, CSS bliver til CSSOM, og stilberegning, layout, paint og compositing giver pixels. Scripts kører på én event loop pr. agent, som defineret i HTML-standarden, og scripts, der blokerer parseren, forsinker renderingen, medmindre de er markeret async eller defer.\n\nBrowsere håndhæver det meste af nettets sikkerhedsmodel på brugerens vegne: same-origin policy og CORS, cookiers afgrænsning og SameSite, partitionering af lager efter topniveau-site, blokering af blandet indhold, HSTS inklusive en preload-liste bygget ind i programmet, CSP og tilladelsesdialoger for kamera, placering og lignende. Udvidelser er det markante svage punkt, fordi de kan have brede værtsrettigheder på tværs af alle sites; Chromiums Manifest V3 indsnævrede nogle muligheder, men ondsindede eller overtagne udvidelser er stadig en vej til tyveri af sessioner. I organisationer styres browsere via politikker (Group Policy eller MDM) med godkendte lister over udvidelser, tvungne opdateringer og begrænset lagring af adgangskoder. En browser er en specialiseret HTTP-klient, forskellig fra den webapplikation, den viser, og fra indlejrede web views i native apps, som ofte mangler den fulde browsers opdateringstakt og beskyttelse."},"edges":[{"type":"requires","to":"cs/http","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/internet","confidence":"high","strength":"normal"},{"type":"kind-of","to":"cs/client","confidence":"high","strength":"normal"}],"depth":5,"sources":[{"title":"MDN Web Docs - How browsers work","url":"https://developer.mozilla.org/en-US/docs/Web/Performance/Guides/How_browsers_work","tier":"official-doc","publisher":"Mozilla"},{"title":"Kurose & Ross, Computer Networking: A Top-Down Approach","tier":"textbook"}],"draft":true}