FBK contributes to the development of the future European standard for browser security

Browsers are the gateway to most of the digital services we use every day and represent one of the main vectors for cyberattacks. To support the implementation of the Cyber Resilience Act (CRA), the European regulation introducing common cybersecurity requirements for products with digital elements placed on the European Union market, European standardization bodies are developing a set of harmonized standards that will translate the regulation’s requirements into technical guidance for manufacturers and developers.

Among these is the standard dedicated to web browsers. The “Securing the Web Browser” project, presented by Giovanni Corti, a researcher with the Security & Trust Unit at the Center for Cybersecurity, has been selected for funding under StandICT, the European Commission’s program supporting experts engaged in standardization activities in the web and ICT sectors. The proposal was evaluated by four independent experts and selected for long-term funding through a highly competitive call.

This recognition highlights an activity that is often overlooked but strategically important: standardization. Standards define the technical rules that make technologies reliable and secure, serving as the link between research, industry, and regulation.

“Standardization is an invisible but fundamental infrastructure of digital innovation. With this project, we are contributing to the development of the standard dedicated to browsers by integrating threat modeling into standardization processes and bringing an established cybersecurity practice into the definition of international standards,” Giovanni Corti explained.

In this field, FBK is among the few Italian research institutions represented in the leading international standardization bodies. As a delegate of the Foundation, Giovanni Corti participates in the work of the World Wide Web Consortium (W3C), where he is a member of the Security Interest Group, which analyzes the security aspects of web standards and technologies, and of ETSI (European Telecommunications Standards Institute), where he contributes to a cybersecurity working group engaged in the development of standards related to the Cyber Resilience Act.

The funded project focuses on the development of the standard dedicated to web browsers  (ETSI EN 304-617 – CRA – Essential Cybersecurity Requirements for Browsers). Corti’s contribution aims in particular to integrate a threat modeling approach, a methodology that makes it possible to identify and analyze threats during the system design phase. The goal is to make the standard more risk-oriented and better aligned with the Cyber Resilience Act by translating the requirements of European legislation into concrete technical guidelines for browser manufacturers.