Browser Security Report Finds Identity Risks Have Migrated to the Web Client

A new industry report finds that the browser has become the new, undefended endpoint, with the majority of emerging identity and data risks now originating from the web client itself, bypassing traditional network and identity security controls. “The 2025 Annual Browser Security Report” from LayerX Security highlights a fundamental disconnect between enterprise security and modern work habits, creating a significant blind spot that attackers are actively exploiting.

The report reveals that traditional identity governance, typically centered on a Single Sign-On (SSO) provider, is failing to capture a large portion of application access. According to the findings, over two-thirds of corporate logins now bypass enterprise SSO. A staggering 68 percent of SaaS authentications occur outside of the managed SSO environment, with 43 percent of those logins using personal, non-corporate accounts.

This unmonitored activity is creating a massive channel for data exfiltration, particularly with the rise of Generative AI. The report found that 77 percent of employees admit to pasting corporate data into GenAI prompts. Alarmingly, 82 percent of those paste actions occur within personal AI accounts that are unmanaged and invisible to the organization’s security team. GenAI now accounts for 32 percent of all corporate-to-personal data movement, making it the number one exfiltration channel in the browser.

Attackers are capitalizing on this shift. The “Scattered Spider” advanced persistent threat (APT) group, for example, has famously focused its attacks on stealing browser session tokens and cookies rather than passwords. By hijacking an active, authenticated session, they bypass multi-factor authentication (MFA) and gain immediate access to sensitive applications.

The report also warns that the browser’s software supply chain is largely ungoverned. While the number of extensions requesting direct access to user identities or cookies is a small fraction (8 percent), many others grant high-level permissions that create a risk of data leakage. This transforms every endpoint into a potential point of data exfiltration, as a malicious extension could silently exfiltrate data or hijack sessions.

The report urges security teams to extend their visibility and policy enforcement “beyond the IdP” and directly into the browser layer to monitor and control data flow and identity usage at the point of origin. Or Eshed, Co-Founder & CEO of LayerX, noted that “the browser isn’t optional anymore – it’s the control plane of every enterprise workflow.”

Sources: LayerX Security Blog, The Hacker News, Browser Security Report 2025.

—

By Ji-seo Kim