New Browser Security Report Reveals Emerging Threats for Enterprises

According to the Browser Security Report 2025, security leaders are recognising that identity, SaaS and AI risks converge in the user’s browser, with traditional controls such as DLP, EDR and SSE operating one layer too low. The report highlights a parallel threat surface created by unmanaged extensions, GenAI tools used via personal accounts, and sessions that bypass SSO, all contributing to data exfiltration within the browser layer.

It notes that 77% of employees paste data into GenAI prompts, and 82% of those pastes come from personal accounts, with 40% of uploaded files containing PII or PCI, and GenAI accounting for 32% of all corporate-to-personal data movement. The findings also flag that 68% of corporate logins occur without SSO, 43% of SaaS logins use personal accounts, and 26% of users reuse passwords across multiple accounts, while 8% of browser extensions access identities or cookies.

The report further observes that 99% of enterprise users have at least one extension, with 54% published by Gmail accounts and 51% not updated in over a year, underscoring the scale of the risk.