Topic route / 14

Browser security

Extension isolation, page messaging, native hosts, release provenance, update pipelines, runtime configuration, and the exact point where web-controlled intent or new code becomes a privileged effect.

Recommended order

Start here, then go deeper.

Start at the web principal, preserve sender context through the extension, and prove exactly which native effect the operating system process can create.

  1. 01
    Native MessagingThe Extension Was Sandboxed. The Native Host Was Not.

    Browser Native Messaging crosses from an untrusted page through an extension into an operating-system process. This research method maps every sender, message, host manifest, parser, native operation, and resulting effect before calling the bridge secure.

    18 min ↗
  2. 02
    Extension messagingThe Page Never Had Permission. The Extension Did.

    A web page cannot call most extension APIs, but it can influence a content script that can message a privileged service worker. This research method proves when that chain becomes a confused deputy and how to reduce it to explicit, testable capabilities.

    21 min ↗
  3. 03
    Update supply chainThe Package Was Signed. The Update Was Still a Security Decision.

    A browser extension update preserves publisher identity while it can change code, permissions, remote configuration, and privileged behavior across an entire installed fleet. This research method turns that release path into an evidence-backed authorization boundary.

    12 min ↗
Full topic archive

Every matching record.

Methods and named-vulnerability research remain visually and editorially separate.