# Browser agents and logged-in sessions: protect the account behind the tab

Source: https://www.web3sec.news/blog/browser-agent-session-security
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Inventory all sessions, roles and recovery authority in the selected profile.
- [ ] Use a dedicated profile and narrowly privileged account.
- [ ] Enforce destination and consequential-action restrictions outside page content.
- [ ] Stage downloads and exclude browser state from exports.
- [ ] Test cross-site denial and service-side session revocation.

## References
- [Chrome: WebMCP agent security considerations, June 2026](https://developer.chrome.com/docs/agents/security/)
- [MDN: HTTP cookies, scope and security attributes](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies)