Post

I’m getting involved in security standards for web browsers as part of my new role at CrabNebula! It’s important to ensure that the web’s security model is not compromised, as browser engines evolve, new browser derivatives become more popular, and brand new web engines emerge.

The European Union’s new law, the Cyber Resilience Act (CRA) requires all commercial software made available in Europe to meet essential cybersecurity requirements, and correctly calls out web browsers as a high-risk type of product with additional security requirements.

ETSI (a European Standards Organization, like Ecma or W3C but specifically authorized to write standards referenced by EU law) is developing a standard for one way to demonstrate that a browser meets these additional cybersecurity requirements.

This browser security standard is in active development, with the work in progress published on ETSI’s website. You can find the current draft in docbox.etsi.org/CYBER/CYBER/... . Look for “browser” within that directory.

We’re very interested in feedback. The easiest way to provide feedback is in a GitLab issue. File issues in labs.etsi.org/rep/stan4cra... . Anyone can sign up for an account and post issues. Please apply the template carefully to give the committee all it needs to address on your comment.

If you’re interested in getting involved, there are a number of free-to-join, publicly streamed conferences coming up which discuss CRA and the “vertical” standards for particular high-risk products including web browsers:

- In Zagreb on January 20th, there will be a “CRA Standards Unlocked” event cyberstand.eu/events/cra-s... , one of several events over the coming months around Europe: cyberstand.eu/events

- In FOSDEM on January 31st in Brussels, in the “CRA in practice” dev room will be open Saturday from 15:00-19:00 in room UA2.114 (Baudoux) fosdem.org/2026/schedul...