What is browser isolation? The complete 2026 guide
Browser isolation separates web execution from a local device. See how architectures differ, which risks they can reduce, and what to verify.
You click a link in an email. The page loads. It looks like your company's login portal. You enter your credentials. Behind the page, obfuscated JavaScript is harvesting everything you just typed and sending it to a server in another country. Your antivirus did not flag it. Your VPN encrypted the traffic faithfully, including the stolen credentials. Your firewall saw an outbound HTTPS connection to a domain that was registered twelve hours ago and looked perfectly normal.
This is a common breach pattern. It succeeds because the browser is both a workspace and an attack surface. Network encryption alone cannot decide whether a login page is legitimate.
Browser isolation changes that equation. It separates some or all web execution from the local device. The exact boundary depends on the product, mode, and data-transfer policy.
Browser Isolation in One Paragraph
Browser isolation is a security technology that executes web content in an environment separated from your local device. Remote products may send a visual stream or a rebuilt document to the local browser. Other products use local sandboxes or mode-specific routing. Isolation can reduce direct endpoint exposure, but file transfer, credentials, extensions, logs, and retention remain separate controls.
How Browser Isolation Works
The core mechanism is straightforward. Browser isolation introduces a layer between the open web and your local device. That layer intercepts web content before it reaches your browser and handles it in three stages.
Stage 1: Detect
When you navigate to a website, the isolation layer intercepts the request. Depending on the product and configuration, it may apply risk scoring to the destination (known malicious domains, newly registered domains, uncategorized sites) or isolate everything by default. The detection stage determines whether the session runs in an isolated environment or passes through to the local browser normally.
Stage 2: Apply the boundary
In remote isolation, the page loads in a container or virtual machine away from the device. The local browser may receive a visual stream or a policy-adjusted document. Local sandboxing and extension-controlled products use different boundaries. Confirm the selected mode before drawing security conclusions.
Stage 3: End and verify
Session cleanup is provider-specific. Closing a tab may end an isolated browser, detach a client, or leave a persistent profile. Verify cookies, storage, downloads, logs, recordings, support access, and infrastructure termination. A close button is not proof of deletion.
For the full technical deep dive into how this architecture works at the implementation level, see How Legba browser isolation works.
What browser isolation changes
Browser isolation changes where web content runs. It can narrow several browser risks. It does not make a page trustworthy or remove the need for identity, endpoint, and data controls.
- Phishing and credential theft. Isolation can separate page execution from local browser state. It cannot make a fake login safe. Credentials typed into a phishing page can still reach the attacker.
- Drive-by downloads and web-based malware. Remote execution can reduce direct endpoint exposure. Download, upload, clipboard, and file-transfer policy determine what can still cross the boundary.
- Browser exploits. Running untrusted code away from the endpoint can narrow the blast radius. The result still depends on the isolation boundary, browser version, transfer controls, and provider infrastructure.
- Browser extensions. Extension risk depends on where the extension runs and which permissions it holds. Isolation does not revoke permissions automatically.
- Session hijacking and token replay. Separate browser state can reduce accidental reuse. Token lifetime, persistence, logs, and revocation remain identity-system decisions.
- File-system access. A remote browser can separate page code from the local file system. Explicit uploads, downloads, mapped drives, and connector permissions can reopen that path.
For specific threat playbooks covering these attack patterns, see the browser threat playbook library.
Types of Browser Isolation
Not all browser isolation works the same way. There are three main architectural approaches, each with different tradeoffs in security, performance, and deployment complexity.
1. Local Browser Isolation
Web content executes in a sandboxed process on the local device, separated from the main browser process but still running on the same hardware. This approach is the lightest in terms of infrastructure (no remote servers needed) but provides the weakest isolation boundary. A sophisticated exploit that escapes the local sandbox can still reach the host operating system.
2. Cloud-Based Remote Browser Isolation (RBI)
Web content executes in a virtual machine or container on a remote server in the cloud. The user's browser receives a pixel stream or reconstructed DOM. This provides the strongest isolation boundary (the execution is on entirely separate infrastructure) but can introduce latency, especially if the cloud server is geographically distant. For a deeper explanation, see What Is Remote Browser Isolation (RBI)?
3. Extension-controlled isolation
A browser extension can select a private route, open a remote browser, or apply another provider-specific boundary. Extension delivery alone does not prove where execution occurs. Verify each mode, protocol, and transfer path separately.
| Dimension | Local Isolation | Cloud RBI | Extension-controlled |
|---|---|---|---|
| Isolation strength | Moderate (same device) | Strong (separate infrastructure) | Provider-specific |
| Latency | Minimal | Variable (distance-dependent) | Provider and workload dependent |
| Deployment | OS or browser config | Network infrastructure | Browser extension |
| Session cleanup | Process terminated | Provider-specific | Verify each mode |
| Typical users | Individual users | Large enterprises | Individuals and teams |
Browser Isolation vs Other Security Tools
Browser isolation is not a replacement for your entire security stack. It addresses a specific gap that other tools leave open.
- VPNs encrypt traffic and mask your IP address. They do not inspect or isolate web content. A phishing page passes through a VPN tunnel and executes normally in your browser. Full comparison here.
- Proxies reroute traffic through intermediary servers. They change your apparent IP address but do not sandbox or sanitize web content. Three-way comparison here.
- Antivirus software scans files and processes on your local device for known malware signatures. Remote browser isolation changes where active web content runs. File transfers and explicit user actions still need separate controls.
- Incognito mode clears local browsing history and cookies when you close the window. It does not isolate web content, hide your IP, prevent fingerprinting, or stop malware. Full comparison here.
The best security posture uses multiple layers. Browser isolation fills the browser-level gap that network and endpoint tools leave open.
Who Needs Browser Isolation
- Anyone who clicks links in emails. If your workflow includes opening links from colleagues, clients, or external contacts, isolation can reduce direct endpoint exposure. It does not make credential entry safe.
- Small and mid-size businesses. Browser isolation can add a focused browser boundary. It still needs clear identity, endpoint, and incident-response ownership. More on SMB cybersecurity here.
- Regulated industries. Law firms, healthcare organizations, and financial services need to protect sensitive data during web-based research and client interactions. Example: browser isolation for law firms.
- Remote and hybrid workers. BYOD devices and home networks lack consistent enterprise controls. Browser isolation can add a boundary, but endpoint posture still matters.
- Teams using AI tools. Browser-based AI usage (ChatGPT, Claude, Gemini) creates data leakage risks. Isolating AI sessions adds a control layer. See the AI security guides.
- Teams comparing managed controls. Evaluate policy scope, reporting, deployment, support access, and tenant boundaries before choosing a provider.
What to evaluate in 2026
Product labels do not reveal the actual boundary. A useful evaluation starts with one representative page and follows every input, output, credential, file, and retained artifact.
Record these facts before procurement:
- Execution location. Identify where the page, scripts, extensions, and browser profile actually run.
- Data transfer. Test uploads, downloads, clipboard, printing, and local integrations.
- Lifecycle. Verify what close, timeout, disconnect, and persistence mean for the selected mode.
- Evidence. Review logs, recordings, support access, retention, deletion, and independent assurance.
For technical foundations, read Legba's sourced primer on browser isolation boundaries.
Where Legba Fits
Legba is a Chrome extension with two modes. Ghost gives your browser a private route. Shield opens a page in an isolated browser off your device.
- Price. $10 a month, or $100 a year.
- Chrome extension. Both modes are available from the browser you already use.
- Ghost. Use a private route for your browser.
- Shield. Open a page in an isolated browser off your device.
- Boundary. Browser isolation is one control. Verify identity, transfer, retention, and endpoint requirements separately.
For security guides organized by use case, see the complete guide library.
Continue the Browser Isolation Deep Dive
The technical architecture, the RBI explainer, and the VPN comparison.
How Legba browser isolation works
Shield runs the page in an isolated browser. That browser is off your device. See what happens when you open the tab. See what ends when you close it.
What is remote browser isolation (RBI)?
Remote browser isolation runs websites away from your device. Your browser receives rendered output. See RBI delivery models, benefits, and limits.
Browser isolation vs VPN: which tool fits in 2026?
VPNs protect a network path. Browser isolation changes where web content runs. Compare their scope, limits, and best uses.
Free for 30 days. No card required.
See Browser Isolation in Action
Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device. $10 a month, or $100 a year.
