Tabnabbing in the browser

How it usually happens in the browser

• A user opens a tab that initially looks legitimate (or innocuous).
• While the tab is in the background, a script changes the page content and title to mimic a login screen.
• The favicon/title often mimic a well-known service to make the tab look familiar.
• When the user returns, they assume they were logged out and re-enter credentials.

What traditional defenses miss

• Users aren’t expecting a page to change after they stop interacting with it.
• Network tools may not block the initial page if it is “clean” at load time.
• Training focuses on links and email, not on tab behavior and dynamic page changes.

How isolation changes the game

• Isolation reduces endpoint exposure to dynamic scripts on untrusted sites and makes risky sessions disposable.
• Policy-based isolation can cover “unknown destinations” where tabnabbing payloads commonly live.
• Session deletion limits the persistence of malicious tabs and reduces leftover state from risky browsing.

Operational checklist

• Isolate unknown domains and common ad/redirect sources by default.
• Encourage use of password managers that only autofill on exact domains.
• Limit or block third-party scripts where possible; use stricter content policies for risky browsing.
• Teach users to re-check the domain on unexpected login prompts—even if it’s a “tab they already opened.”
• Prioritize phishing-resistant MFA for critical apps to reduce impact from credential entry.

FAQs.