Man-in-the-Browser Attack
Pronunciation: man in thuh BROW-zer uh-TAK
Also known as: Browser-in-the-middle malware, MitB attack
Definition
A man-in-the-browser attack uses malicious browser code, an extension, injected script, or endpoint malware to observe or alter a transaction inside the user’s browser session. It differs from a network man-in-the-middle attack because the manipulation occurs at or within the trusted endpoint after secure transport may already be established.
Overview
Meaning and scope
A man-in-the-browser attack uses malicious browser code, an extension, injected script, or endpoint malware to observe or alter a transaction inside the user’s browser session. It differs from a network man-in-the-middle attack because the manipulation occurs at or within the trusted endpoint after secure transport may already be established.
Mechanism and operation
The principal failure modes include form manipulation, credential theft, session abuse, altered payment addresses, fake confirmation screens, hidden transaction changes, and bypass of TLS protections. Useful measures include browser-integrity alerts, altered-transaction detections, extension policy compliance, confirmed endpoint compromises, and customer-reported discrepancies. Operationally, teams should harden endpoints, restrict extensions, protect payment pages, and use transaction-specific confirmation. Key risks include form manipulation, credential theft, session abuse, and altered payment addresses. Assessment of Man-in-the-Browser Attack should trace the use of malicious browser code, an extension, injected script, or endpoint malware to observe or alter a transaction inside the user’s browser session from prerequisite and entry point through observable impact on the affected service.
Practical payment example
Malware changes the beneficiary account shown during a payout session. The treasury adds independent out-of-band confirmation of material payment details rather than trusting the infected browser display.
Operational checks
A theoretical weakness or scanner result involving malicious browser code, extension, and injected script should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Man-in-the-Browser attack path should be tested against the architecture associated with malicious browser code, extension, and injected script.
Distinctions and limits
Operational implementation should harden endpoints, restrict extensions, protect payment pages, use transaction-specific confirmation, verify beneficiary and amount out of band for high-risk actions, monitor script integrity, and detect abnormal browser behavior.
Related reading
Related definitions: Man-in-the-Middle Attack (MITM), Payment Page Script Attack.
Example
Malware changes the beneficiary account shown during a payout session. The treasury adds independent out-of-band confirmation of material payment details rather than trusting the infected browser display.
Comparison
It differs from a network man-in-the-middle attack because the manipulation occurs at or within the trusted endpoint after secure transport may already be established. Operational implementation should harden endpoints, restrict extensions, protect payment pages, use transaction-specific confirmation, verify beneficiary and amount out of band for high-risk actions, monitor script integrity, and detect abnormal browser behavior.
Key Takeaway
A man-in-the-browser attack uses malicious browser code, an extension, injected script, or endpoint malware to observe or alter a transaction inside the user’s browser session.
Sources
- OWASP Client-Side Security Top 10 — OWASP (2026-08-03)
- MITRE ATT&CK Enterprise Knowledge Base — MITRE (2026-08-03)
- PCI DSS v4.0.1 E-commerce Guidance and Requirements — PCI Security Standards Council (2026-08-03)