Over the past two decades, the browser has evolved from a simple web rendering engine to the primary gateway through which users interact with the internet, be it for work, leisure or transactions. In other words, browsers are becoming the new endpoint. Yet, despite the exponential growth of browser-native attacks, traditional security solutions continue to focus on endpoint and network, leaving a large gaping hole when it comes to browser security.

To tackle this issue, we are starting the Year of Browser Bugs (YOBB), a yearlong initiative to draw attention to the lack of security research and rigor in what remains one of the most understudied attack vectors - the browser.

The YOBB project was inspired by Month of Bugs (MOB), an iconic cybersecurity initiative where security researchers would publish one major vulnerability found in major software providers for every day of the month. MOB projects played a huge role in improving the gravity at which security and responsible disclosure is taken in these companies.

SquareX's research team is bringing back this tradition. We will disclose at least one critical web attack per month as part of the YOBB project, focusing on vulnerabilities that exploit architectural limitations of the browser and security incumbents. The research will reveal novel attack vectors discovered by our own research team. Each disclosure will include attack video demonstrations, technical breakdowns, and mitigation strategies.