Post

I’m getting involved in security standards for web browsers as part of my new role at CrabNebula! It’s important to ensure that the web’s security model is not compromised, as browser engines evolve, new browser derivatives become more popular, and brand new web engines emerge.

The European Union’s new law, the Cyber Resilience Act (CRA) requires all commercial software made available in Europe to meet essential cybersecurity requirements, and correctly calls out web browsers as a high-risk type of product with additional security requirements.

ETSI (a European Standards Organization, like Ecma or W3C but specifically authorized to write standards referenced by EU law) is developing a standard for one way to demonstrate that a browser meets these additional cybersecurity requirements.

This browser security standard is in active development, with the work in progress published on ETSI’s website. You can find the current draft in docbox.etsi.org/CYBER/CYBER/... . Look for “browser” within that directory.

We’re very interested in feedback. The easiest way to provide feedback is in a GitLab issue. File issues in labs.etsi.org/rep/stan4cra... . Anyone can sign up for an account and post issues. Please apply the template carefully to give the committee all it needs to address on your comment.

This effort isn’t about mandating new practices from an ivory tower, but rather collecting best practices deployed today and encouraging their consistent usage more broadly. We need browser engineers and web security experts to be involved to accurately document these security best practices.

- In Zagreb on January 20th, there will be a “CRA Standards Unlocked” event cyberstand.eu/events/cra-s... , one of several events over the coming months around Europe: cyberstand.eu/events

- In FOSDEM on January 31st in Brussels, in the “CRA in practice” dev room will be open Saturday from 15:00-19:00 in room UA2.114 (Baudoux) fosdem.org/2026/schedul...

Another path to involvement is to become a paid (!) contributor to these standards via a CYBERSTAND.eu grant. Find more information at cyberstand.eu/10th-specific-service-procedure-sme-perspective . Please apply even if you’re not sure if you are qualified!