Web browsers regularly download data from untrusted sources. Such data may contain executable malicious code that can exploit vulnerabilities and infect the user’s IT system without their knowledge.

This may include code (in JavaScript or WebAssembly, for example) that can be directly executed by the web browser. It can also involve the executable code of a plug-in or an extension in connection with the browser and Java or parts of PDF documents, for example. Finally, code can be downloaded by a web browser onto a client and executed there outside of the browser's process. A failure to make adequate use of the basic protection mechanisms of state-of-the-art web browsers threatens the confidentiality, integrity, and availability of information or services on the client side, and potentially in any connected networks, as well.