Cloudflare Acquires S2 Systems to Reinvent Remote Browser Security
Cloudflare has acquired S2 Systems, a Seattle-area startup whose remote browser isolation technology takes a fundamentally different approach from existing solutions. By intercepting browser draw commands rather than streaming pixels or reconstructing HTML, S2’s patented Network Vector Rendering (NVR) aims to eliminate the tradeoffs that have kept browser isolation from being widely deployed.
The browser problem that won't go away
The web was designed more than three decades ago for a few thousand creative users, not for billions of people conducting commerce, business and daily communication. Its foundational architecture predates security, privacy and compliance concerns, and modern browsers are built on a sprawling, constantly evolving stack of interrelated technologies. That complexity makes them the primary attack vector for endpoint compromises: legitimate functions like file downloads, cross-site content loading and advertising enable malware delivery, cross-site scripting and malicious redirects.
Enterprises face additional pressures. IT departments have little visibility into browser activity, limited control over file transfers for content disarm and reconstruction (CDR) or data loss prevention (DLP), and difficulty meeting compliance requirements across geographies. Signature-based defenses and URL/DNS blocklists are inherently reactive and vulnerable to zero-day exploits, while attackers automate around them with an 11x escalation in attacks since 2016.
Isolation, but at what cost?
Browser isolation is a zero-trust alternative: keep web code execution away from the endpoint entirely. Local isolation, which sandboxes a browser on the device itself, still leaves the endpoint exposed if the sandbox fails, consumes significant resources, and does nothing for control or compliance. Remote browser isolation (RBI) moves execution to the cloud, with one disposable browser instance per user session that is terminated as if compromised when the session ends.
But current RBI systems force a choice between two flawed remoting technologies:
- Pixel pushing streams video of the remote browser to the endpoint. It’s secure but expensive to operate at scale, bandwidth-hungry, latency-prone, poor on mobile and degraded on HiDPI displays.
- DOM reconstruction scrubs and rewrites HTML, CSS and other content before forwarding it to the local browser. It’s faster and cheaper, but the very technologies being "cleaned" remain attack vectors, and reconstructing modern websites inevitably breaks them — often in ways that change as publishers update their sites daily.
Some vendors implement both and let customers choose their poison. Many organizations respond by isolating only high-risk users — executives, finance, HR — which provides a false sense of security without protecting the broader organization. The gap between the promise of browser isolation and its implementation has kept it from mainstream adoption.
A different way to render remotely
S2’s remote browser runs headless Chromium in the cloud. Because Chromium renders everything visible in a browser window through the Skia graphics library, S2 intercepts the Skia draw commands before rasterization, when they are highly compact. The commands are tokenized, compressed, encrypted and sent over the wire to any HTML5-compliant browser on the endpoint.
On first use, a WebAssembly (Wasm) library is pushed to the local browser and cached. The Wasm code contains an embedded Skia library that unpacks and replays the draw commands at near-native speed, taking advantage of hardware capabilities available across platforms.
This architecture claims several advantages over existing RBI approaches:
- Security: The draw-command transport is not a known attack vector, so there is no tradeoff between security and performance.
- Website compatibility: No reconstruction means no broken pages and no long tail of chasing publisher changes.
- Performance: S2 says the system is typically faster than local browsing.
- Transparency: Users generally can't tell they're on a remote browser.
- Bandwidth: Draw commands often require less bandwidth than loading the original page locally, with caching optimizations available.
- Clientless: Works in any existing HTML5 browser on desktop or mobile.
- Cost: Lower backend operating costs make whole-enterprise deployment — rather than "vaccinating half the class" — practical.
- Platform: The NVR layer can support adjacent services like DLP, CDR and phishing prevention.
Because the remote browser uses Chromium — which powers Google Chrome and twenty-one other browsers including the new Microsoft Edge — it inherits ongoing compatibility investment. Similarly, Skia's use across Chrome, Android, Firefox, Flutter and Electron ensures broad hardware and platform support.
How it fits Cloudflare's network
Cloudflare plans to integrate the S2 service into its Cloudflare for Teams security suite. The company’s edge network, with Workers running in 200 cities across more than 90 countries, would place a remote browser within 100 milliseconds of 99% of the Internet-connected population in the developed world. With over 20 million Internet properties already connected, locally cached data and Argo Smart Routing — which averages 30% faster access to web assets — would further improve performance.
The acquisition reflects Cloudflare’s broader mission of protecting users as they work and play on the Internet. For enterprises, the goal is browser security that covers all employees without compromising user experience, control or compliance. For end users, it's web browsing without fear or consequence. Whether the NVR approach delivers on these promises in production at Cloudflare scale remains to be seen, but the acquisition marks a notable shift in how remote browser isolation might finally be broadly deployed.
