Draft Details

The present document specifies technical requirements and corresponding assessment criteria for web browsers related 
to cybersecurity. The products with digital elements in scope, thereafter "the products" are specified within the 
"technical description" of the "category of product" number "2" by the Commission Implementing Regulation (EU) 
2025/2392 [i.2] as: 
• "Software products with digital elements that enable end users to access, render, and interact with web content 
and services hosted on servers that are connected to networks such as the Internet. They typically include a 
browser engine for interpreting and displaying content written in markup language (e.g. HTML), support for 
web protocols (e.g. HTTP, HTTPS), the ability to execute scripts and manage user inputs as well as storage of 
temporary or persistent data from websites (cookies). 
This category includes but is not limited to standalone applications that fulfil the functions of browsers, embedded 
browsers intended for integration into another system or application as well as browsers with AI agent integration." 
The products are only covered within the product context described in clause 4. The present document specifies 
technical characteristics and methods of assessment for: 
• Standalone web browsers: standalone applications that fulfil the functions of web browsers 
• Embedded web browsers: embedded browsers intended for integration into another system or application 
The present document covers those products to demonstrate compliance with essential cybersecurity requirements in the 
Regulation (EU) 2024/2847 [i.1] Annex I Part I under the conditions identified in Annex A. 
Browsers with AI agent integration are out of the scope of the present document as well.