What is browser isolation? The complete 2026 guide
Browser isolation separates pages from the rest of your system. Compare the three types and what to verify.
Browser isolation keeps web pages away from your operating system. CISA's browser security guide calls it a logical barrier. Local isolation runs pages in a sandbox on your device. Remote isolation moves page processing off your device. Neither form makes a fake login page safe.
What is browser isolation?
Browser isolation runs web content in a separate environment. The environment sits between pages and your operating system. Local products use a sandbox or virtual machine. Remote products use a browser on separate infrastructure. The RBI guide explains how remote pages reach your screen. Files, credentials, extensions, logs, and retention need separate controls.
How browser isolation works
Most isolation products work in three stages.
Stage 1: choose what to isolate
A policy decides which pages get isolated. Some teams isolate every page. Others isolate only risky categories. Cloudflare's isolation policies can target known security threats. They can also target newly registered or uncategorized sites. Pages outside the policy load normally.
Stage 2: apply the boundary
Remote isolation loads the page in a remote container. Local isolation keeps it in a sandbox on the device. Extension-controlled products vary by mode. Confirm the selected mode before drawing conclusions.
Stage 3: end and verify
Session cleanup is provider-specific. Closing a tab may end the isolated browser. It may also leave a persistent profile behind. Verify cookies, storage, downloads, logs, and recordings. Ask who can access sessions for support. A close button is not proof of deletion.
For Legba's two modes, read how Legba browser isolation works.
What browser isolation changes
Browser isolation changes where web content runs. It can narrow several browser risks. It does not make a page trustworthy. Identity, endpoint, and data controls still matter.
- Phishing and credential theft. Isolation can separate page code from local browser state. It cannot make a fake login safe. Typed credentials still reach the attacker.
- Drive-by downloads and web-based malware. Remote execution can reduce direct endpoint exposure. Transfer policy decides what still crosses the boundary. See the malicious downloads playbook.
- Browser exploits and zero-days. CISA says separation reduces the impact of exploits. It confines malicious code to a temporary environment. The boundary, browser version, and provider still matter. See browser zero-day exploits.
- Risky browser extensions. Extension risk depends on where it runs. It also depends on the permissions it holds. Isolation does not revoke those permissions.
- Session hijacking and token replay. Separate browser state can reduce accidental reuse. Token lifetime and revocation stay identity decisions.
- File-system access. A remote browser separates page code from local files. Uploads, downloads, and mapped drives can reopen that path.
Browse the threat playbook library for specific attacks.
What are the types of browser isolation?
Browser isolation comes in three main architectures. Each trades security, speed, and deployment effort differently.
1. Local browser isolation
Local isolation runs pages in a sandbox or virtual machine. Everything stays on the same hardware. No remote servers are needed. An exploit that escapes the sandbox can reach the host.
Microsoft Defender Application Guard is a built-in example. It opens untrusted sites in an isolated container. Microsoft has deprecated it for Edge. Windows 11, version 24H2, no longer offers it.
2. Remote browser isolation (RBI)
Remote isolation runs pages on separate infrastructure. Your browser receives pixels, a filtered page, or drawing instructions. Active page code runs remotely. Distance to the remote browser can add lag. The RBI guide compares the delivery methods.
3. Extension-controlled isolation
Some products use a browser extension as the control. One mode may open a remote browser. Another may only change the network route. A route change is not isolation. Verify each mode and transfer path separately.
How we compared the three types
The table below compares architectures, not products. Entries draw on CISA guidance and vendor documentation. Products can mix more than one type.
| Dimension | Local isolation | Remote isolation (RBI) | Extension-controlled |
|---|---|---|---|
| Where page code runs | Sandbox or virtual machine on your device | Separate infrastructure | Depends on the mode |
| Network delay | No extra network hop | Varies with distance | Depends on the mode |
| Deployment | OS or browser setting | Network or cloud service | Browser extension |
| Session cleanup | Depends on persistence settings | Set by provider policy | Verify each mode |
Browser isolation vs other security tools
Browser isolation does not replace other security tools. It covers where untrusted page code runs.
- VPNs encrypt traffic and mask your IP address. They do not isolate web content. A phishing page still runs in your browser. Compare browser isolation and VPNs.
- Proxies relay traffic through an intermediary server. They change your apparent IP address. They do not sandbox web content. Compare VPNs, proxies, and isolation.
- Antivirus software scans files and processes on your device. Isolation changes where web code runs instead. Downloaded files still need scanning.
- Incognito mode discards site data when the session ends. Google says websites and network operators can still see activity. Incognito does not isolate page code from your device. Compare isolation and incognito.
- Site Isolation in Chrome separates sites into sandboxed processes. Chromium made it the default on desktop in Chrome 67. It defends sites against each other inside the browser. Browser isolation instead separates the browser from the system.
Layered controls fail in different ways. Browser isolation adds one boundary where pages run.
Who needs browser isolation?
- People who open outside links. Isolation can reduce endpoint exposure from unfamiliar links. It does not make credential entry safe.
- Small and midsize businesses. Isolation adds one focused browser boundary. Identity, endpoint, and incident response still need owners. Read about the 60% small-business closure claim.
- Regulated professional firms. Law, healthcare, and finance teams handle sensitive client data. Isolation is one control they can assess. See guides for law firms and tax firms.
- Remote and hybrid workers. Personal devices and home networks vary widely. Isolation adds a boundary, but device health still matters.
- Teams using AI tools. Isolation changes where an AI site's code runs. It does not stop staff pasting data into prompts. See the AI security guides.
- Teams comparing managed services. Compare policy scope, reporting, and support access first. See enterprise browser vs remote browser isolation.
What to evaluate in 2026
Product labels do not reveal the actual boundary. Start with one representative page. Follow every input, output, credential, file, and artifact.
Record these facts before procurement:
- Where execution happens. Identify where pages, scripts, extensions, and profiles run.
- What data can cross. Test uploads, downloads, clipboard, printing, and integrations.
- What close really ends. Verify close, timeout, disconnect, and persistence for each mode.
- What evidence exists. Review logs, recordings, support access, retention, and audits.
Where Legba fits
Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.
Shield is the isolation mode. Ghost changes only the route. Both work inside the Chrome you already use. Downloads and copied data still cross Shield's boundary.
The extension costs $10 a month, or $100 a year. Treat isolation as one control. Verify identity, transfer, and retention needs separately.
Browse the guide library by use case.
Sources were checked on October 30, 2026.
Continue the browser isolation guide
Legba's modes, the RBI explainer, VPNs, and agents.
How Legba browser isolation works
Shield runs the page in an isolated browser. That browser is off your device. See what happens when you open the tab. See what ends when you close it.
What is remote browser isolation (RBI)?
Remote browser isolation runs websites off your device. Your browser gets pixels, page structure, or drawing instructions. See how RBI works and its limits.
Browser isolation vs VPN: which tool fits in 2026?
VPNs protect a network path. Browser isolation changes where web content runs. Compare their scope, limits, and best uses.
Free for 30 days. No card required.
See browser isolation in action
Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device. $10 a month, or $100 a year.
