The Bottom Line: Browser permissions enable encryption and extortion of sensitive data on devices without technical knowledge or malware installation.
Security research shows: AI-driven attacks enable ransomware functionality directly in the web browser without installation or exploits. A single permission click can grant access to years of mobile photos, identity documents, and recovery codes.
Researchers have demonstrated that modern web browsers possess sufficiently privileged access rights to implement ransomware scenarios – entirely within the browser context, without requiring an app download, exploit use, or technical knowledge. The attack path reduces to a user granting a standard browser permission.
The security risk lies in the combination of broad file access rights in modern browsers (such as via the File System Access API or Storage API) and AI-driven jailbreaks that generate social engineering messages. A user confirms a seemingly harmless permission – for example, for access to local files – and thereby enables access to sensitive content such as multi-part collections of mobile photos, identity documents, or authentication codes.
For Chief Information Security Officers, this represents a new attack surface beyond malware distribution, exploits, and desktop software. Browser-based ransomware can access company-owned or employee personal devices without classical endpoint protection measures being effective. The threat requires awareness of permission requests and evaluation of browser isolation or zero-trust principles for web applications.
Source: itwelt.at · Published 2 July 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.2.