Browser and web protection
DNS filtering and your own blocked and allowed lists on the phone; page-level browser protection is not built.
- Available
- 02
- Limited
- 02
- Not released
- 00
- Coming
- 02
How the attack works
The browser is where untrusted content meets your accounts. Malicious ads, fake download buttons and over-privileged extensions turn ordinary browsing into a way in, and a tampered DNS setting can silently send you to the wrong server for a real domain name.
- STAGE 01
Exposure
A search ad, a pop-up or a "your browser is out of date" page on an otherwise normal site.
- STAGE 02
Delivery
A download disguised as an installer or document, or an extension that asks to "read and change all your data on all websites".
- STAGE 03
Persistence
The extension stays installed and sees every page; a changed DNS setting redirects lookups for real domains.
- STAGE 04
Abuse
Session cookies, form contents or search traffic are collected or redirected.
- Anyone who installs software from search results
- Users who install many browser extensions
- Home networks with a router that has default credentials
A common pattern: a search for a popular free tool shows a paid ad above the real result. The ad leads to a convincing copy of the download page, and the installer bundles something else alongside, or instead of, the real program.
Malicious downloads, fake ads and browser extensions that read every page are a common way in, on phones and computers alike.
Sensor, rule, evidence, action
Each step carries its own state. A step that is not built is shown as coming, not skipped.
Download folder hashing
The desktop file monitor hashes new files in Downloads. No reputation check uses the hash yet.
Not releasedDesktop (unsigned pre-release)DNS filtering and extension risk
On the phone an opt-in local DNS filter refuses names on your blocked list and the signed threat list. Rating extensions by permission is planned.
AvailableAndroid 4.8 and laterProtection status
The phone shows whether a protected browser setup is active.
LimitedAndroid 4.50Your own allow and block lists
Lists you control, applied on the device and shared with the web portal Site lists.
AvailableAndroid 4.7 and later
We will not read your browsing history; it is classified restricted and never leaves the device (privacy spec §2).
Protection will run as DNS filtering and a browser integration, with blocked and allowed lists you control.
What works today, and what is coming
What works today
04In production or in the current download.
- DNS protection on the phoneAvailable
An opt-in local VPN that carries only DNS lookups: a name on your blocked list or on the signed threat list is refused. It covers apps that use the phone's normal DNS; an app with its own encrypted DNS is not covered, and the limits are stated on screen.
Android app 4.50 (4.8 and later)
- Blocked and allowed sitesAvailable
Your own lists, applied on the phone and shared with the web portal Site lists.
Android app 4.50
- Browser protection statusLimited
Shows whether a protected browser setup is active.
Android app 4.50
- Web protection settings in the portalLimited
Site lists are live; enforcing them on computers needs agent endpoints that are not built.
Web portal
Built, not yet released
00The code exists and is tested in the repository; it has not shipped to users.
Nothing in this group yet.
Coming
02Not built yet. Nothing on this list runs today.
- Seeing the pages you openComing
Browser integration that lets Sentinel check pages as you browse. Today Sentinel only sees links you check yourself.
- Browser extension riskComing
Detecting extensions that request dangerous permissions.
Desktop
3 attack families map to this capability
Copied row by row from our engineering register. A family counts as detected only when a rule, a sensor that feeds it and a test that makes it fire all exist.
Feature states above and register statuses measure different things: a feature can be built while the family it addresses stays unobserved, because the register counts sensors and rules, not screens.
| # | Attack family | Status | What the register says |
|---|---|---|---|
| 041 | Malvertising / Drive-by Download | Observable | The desktop file monitor hashes new files in Downloads, but no reputation check or rule looks at them. Repository only.Repository only |
| 042 | Malicious Browser Extension | No sensor | No browser extension inventoryNothing runs |
| 043 | DNS Hijacking / Poisoning | No sensor | No resolver-configuration or DNS telemetry in any running buildNothing runs |
What runs where, and what never leaves
Classification happens on the device before anything is queued. Cloud reporting is off by default on consumer devices and turning it off also stops events already queued.
Runs on the device
- Hashes of files in your Downloads folder (desktop)
- Your future allow and block lists
May reach the cloud
- Nothing today
Never leaves
- Browsing history
- Page contents, cookies and form data
- The URLs you visit
Editions that include it
Local-first protection for your own computer and phone.
> One person, 1–3 devices
Android protection you can install today.
> Android phone owners
One summary for the whole household, without reading anyone's phone.
> Households with supported paired phones
Each feature above names the platform or edition it runs on. An edition's own page lists the full state of that edition.
What to do if…
Practical steps that work whether or not you use our products.
You installed something from an ad
- 1.Uninstall it, then download the program again from the publisher's own site.
- 2.Run a scan with your operating system's built-in protection.
- 3.Change passwords you typed on that computer since the install.
Your browser has extensions you do not remember adding
- 1.Remove them. Keep only extensions you use, from publishers you recognise.
- 2.Check each remaining extension's site access and restrict it to the sites it needs.
Familiar sites suddenly show certificate warnings
- 1.Do not click through the warning.
- 2.Check your router's DNS settings and change its admin password.
- 3.Try from mobile data; if the warning disappears, the network is the problem.
Limits and known gaps
- GAP-01Almost all of this capability is planned. The web-protection page in the portal exists, but the agent endpoints it calls are not implemented by any agent.
- GAP-02The register counts malvertising/drive-by download as observable only (files are hashed, nothing checks them) and malicious extensions and DNS hijacking as not observable.
- GAP-03A Windows DNS event mapping exists in the repository, but there is no live session, so it is not counted.
Frequently asked
Is there a browser extension?
Will you log my browsing to protect me?
Capabilities that work alongside it
Checks a link before you open it and warns about lookalike domains.
Wi-Fi and connection awareness on phones; port-scan visibility and firewall control on servers.
Known-malware scans, automatic protection and fake-app checks on the phone; ransomware warnings on servers.