Web browser

The first browser, WorldWideWeb, was written by Tim Berners-Lee in 1990; NCSA Mosaic (1993) brought inline images and mass adoption. Today three engine lineages remain: Blink with the V8 JavaScript engine (Chromium, and therefore Chrome, Edge, Opera, Brave and others; forked from WebKit in 2013), Gecko with SpiderMonkey (Firefox) and WebKit with JavaScriptCore (Safari, and on iOS historically every browser). Engine concentration matters for security: a flaw in Blink or V8 affects most of the desktop market at once.

Modern browsers are multi-process systems. A privileged browser process handles the UI, storage and network (in Chromium a separate network service), while web content runs in renderer processes confined by an OS sandbox (seccomp-bpf and namespaces on Linux, restricted tokens and job objects on Windows), with GPU work in its own process. Since Chrome 67 (2018), site isolation places different sites in different renderer processes so a compromised renderer or a Spectre-style side channel cannot read another site's data. Full remote compromise therefore usually requires a chain: a renderer bug, very often type confusion or use-after-free in the JIT-compiling JavaScript engine, plus a separate sandbox escape. Short release cycles (Chrome every four weeks, Firefox similarly) and silent auto-update exist to shrink the window between patch and exploitation.

Loading a page follows a well-defined pipeline: DNS resolution, TCP or QUIC connection, TLS handshake with certificate path validation and, in Chrome and Safari, Certificate Transparency enforcement, then the HTTP exchange; the HTML parser builds the DOM, CSS becomes the CSSOM, and style calculation, layout, paint and compositing produce pixels. Scripts run on a single event loop per agent, as defined by the HTML Standard, and parser-blocking scripts delay rendering unless marked async or defer.

Browsers enforce most of the web's security model on the user's behalf: the same-origin policy and CORS, cookie scoping and SameSite, storage partitioning by top-level site, mixed-content blocking, HSTS including a preload list compiled into the binary, CSP and permission prompts for camera, location and similar capabilities. Extensions are the notable weak point, since they can hold broad host permissions across all sites; Chromium's Manifest V3 narrowed some capabilities, but malicious or hijacked extensions remain a route to session theft. In organisations, browsers are managed through policy (Group Policy or MDM), with extension allowlists, forced updates and restricted password saving. A browser is a specialised HTTP client, distinct from the web application it displays and from embedded web views inside native apps, which often lack the full browser's update cadence and protections.