What is remote browser isolation (RBI)?
RBI keeps active page code off your device. See the three delivery methods and what RBI cannot stop.
Remote browser isolation (RBI) runs websites off your device. A remote browser loads each page and its code. Your browser receives a controlled view. You still click, type, and scroll.
RBI changes where page code runs. It reduces direct exposure to untrusted websites. It does not make those websites trustworthy. Typed passwords still reach the site. Files and clipboard text can cross too.
How remote browser isolation works
CISA's browser security guide describes two forms of isolation. Local isolation uses a sandbox or virtual machine. It runs on the user's own computer. Remote isolation moves web processing off that computer. It runs in a virtualized environment or isolated cloud platform.
- Route the page. A policy sends chosen requests to a remote browser. Policies can isolate every page or a selected list.
- Run the page remotely. The remote browser loads the site and runs its code. That code does not start in your local browser profile.
- Return a controlled view. The service sends pixels, filtered page structure, or drawing instructions. Your clicks and keystrokes go back to the remote page.
- Apply the session policy. Providers decide when the remote browser resets. They also decide what state to retain. Check that policy before relying on a fresh session.
Delivery methods and deployment location
RBI services differ in what reaches your browser. Vendor documentation describes three delivery methods. Each still needs a local client for display and input.
| Method | What reaches your browser | Documented by | What to test |
|---|---|---|---|
| Pixel streaming | Rendered frames, not the page's active code | Zscaler | Lag with distance, bandwidth, text clarity |
| DOM mirroring | Page structure with scripts filtered out | Menlo Security | What the filter removes, site compatibility |
| Network vector rendering | Drawing instructions, not pixels or video | Cloudflare | Canvas-heavy apps, typing and scrolling feel |
How we compared delivery methods
Each row summarizes that vendor's own documentation. Vendors describe rival methods less favorably. We did not benchmark these methods. Measure speed and compatibility on the sites you use.
The remote browser may run in a data center. Some services run it at a network edge. Location is separate from the delivery method. Neither label proves low latency or stronger security. Compare two services in Cloudflare Browser Isolation vs Zscaler.
What RBI changes, and what it does not
- Page code runs remotely. Scripts execute in the remote browser. The boundary limits their reach into your local profile.
- Credentials still reach the site. A phishing page still receives secrets you type. RBI does not verify that a site is genuine.
- Files and clipboard can cross. Downloads, uploads, and clipboard actions carry data. Controls differ by provider and policy.
- Identity survives the session. A website can identify you when you sign in. A reset does not erase what you shared.
Cloudflare's isolation policies show how these controls vary. Copy, paste, downloads, uploads, and printing each have a setting. Each one defaults to Allow. Isolation also does not replace identity or endpoint controls.
RBI versus browser isolation
Browser isolation is the broader category. It separates untrusted pages from everyday browsing. RBI does this by running pages off the device. A local sandbox keeps execution on the device. See our browser isolation guide for the wider category.
How to evaluate an RBI service
- Confirm where code runs and what reaches your browser.
- Test credentials, downloads, uploads, clipboard, and printing.
- Check session reset, retained data, and network reach.
- Measure latency and compatibility on your actual websites.
Read how RBI changed from 2022 to 2026.
Questions about remote browser isolation
Does remote browser isolation stop phishing?
RBI does not stop phishing by itself. It keeps a phishing page's code off your device. It cannot stop you typing a password into that page. Check the login address before you sign in. Use phishing-resistant sign-in where you can.
Does RBI slow down browsing?
RBI can add delay. Zscaler notes that lag grows with distance. It also notes that pixel streaming needs heavy bandwidth. Cloudflare says its drawing instructions are lighter than pixels. Measure typing and scrolling on your own sites.
How is RBI different from an enterprise browser?
An enterprise browser governs work inside the browser software. RBI runs active page content somewhere else. Some platforms now combine both approaches. See enterprise browser vs remote browser isolation.
Can RBI protect an AI agent's browsing?
RBI can run an agent's pages away from its host. Untrusted page text can still steer the agent. Indirect prompt injection needs separate controls. Read browser isolation for AI agents.
Where Legba fits
Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.
Shield isolates the page you open. Its remote session ends when you close the tab. Ghost changes the route your browser uses. The page still runs locally in Ghost.
Read how Legba's two modes work. Compare Chrome isolation options for 2026.
Sources were checked on October 30, 2026.
Continue the RBI guide
The wider category, Legba's modes, Chrome options, and agents.
What is browser isolation? The complete 2026 guide
Browser isolation keeps web pages away from your operating system. Compare local, remote, and extension-controlled types and their limits.
How Legba browser isolation works
Shield runs the page in an isolated browser. That browser is off your device. See what happens when you open the tab. See what ends when you close it.
Best browser isolation and security extensions for Chrome in 2026
Seven browser isolation and security options for Chrome. Compare where pages run, owners, and buying paths.
Free for 30 days. No card required.
Open a page away from your device
Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.
