Does the Cyber Resilience Act Apply to Web Browsers?
Learn if the EU CRA applies to Web Browsers, what the core compliance requirements are, and how to start preparing your engineering teams automatically.
Core Definition
Yes. The EU Cyber Resilience Act applies directly to Web Browsers as they fall under the definition of "products with digital elements." A browser is one of the largest attack surfaces a user runs — CRA's exploit-mitigation and secure-update expectations are especially demanding for this category. This means your software must meet mandatory cybersecurity requirements to be distributed in the EU market.
Key Compliance Steps for Web Browsers
- Determine Classification: Check if your Web Browsers falls under the default category or Class I/Class II, which dictate stricter conformity assessment paths.
- Perform Risk Assessment: Map out the attack surface for your software and document the mitigations for the "secure by design" requirement.
- Implement Vulnerability Reporting: Provide a 24-hour reporting mechanism to ENISA for actively exploited vulnerabilities.
- Generate an SBOM: Ensure all dependencies used in your Web Browsers are documented in a machine-readable Software Bill of Materials.
- Avoid the Common Pitfall: Extension and plugin ecosystems get treated as 'third-party responsibility' when the browser vendor still needs to document the supply-chain risk they introduce.
How This Plays Out in Practice
A browser is one of the largest attack surfaces a user runs — CRA's exploit-mitigation and secure-update expectations are especially demanding for this category.
What to Watch For
Extension and plugin ecosystems get treated as 'third-party responsibility' when the browser vendor still needs to document the supply-chain risk they introduce.
Assess Your CRA Readiness
Evaluate your product's Cyber Resilience Act readiness using our interactive tool. Find exactly which of the 22 security requirements apply directly to Web Browsers.