Every computer connected to the internet relies on the same paradox: the application that provides the greatest access—the web browser—is also the largest open door for threats. As the modern workplace shifts more of its daily operations into browsers, from internal dashboards to SaaS suites like Office 365 and Google Workspace, the browser has become the enterprise application least under control. Users click malicious links, install risky extensions, or sync corporate data to personal devices; asset management and MDM tools often lag behind zero-day disclosures, forcing frantic mass patches that, by definition, arrive after the fact.

The traditional response has been to isolate the browsing session itself. Browser isolation services move the browsing logic away from the user’s machine and into a virtualized environment in the cloud, ensuring that any malware encountered stays trapped in a disposable container. But the two most common approaches to this isolation degrade the core browser experience in ways that enterprises have found unacceptable.

  • Pixel streaming: Recording the remote browser and shipping a live video feed back to the user adds latency and makes common interactions like entering text or dragging elements feel unresponsive.
  • Content repackaging: Fetching a webpage, stripping out unsafe components, then re-serving the sanitized HTML, CSS, and JavaScript risks both missing subtle threats and, just as often, breaking the page itself.

A Different Isolation Model: Drawing, Not Streaming

We are now opening a beta of a third route. With Cloudflare Browser Isolation, actual browser sessions run in sandboxed containers inside Cloudflare’s global network. Rather than sending users a pixel stream or a modified version of the page, the service forwards the browser’s rendering output: a compact set of draw commands the local device uses to reconstruct the interface in any HTML5-compliant browser. The page content itself stays in the cloud, which also sidesteps the layout and functionality compatibility issues that arise when pages are rewritten on the fly.

Keeping these sessions hyperlocal is central to making the experience seamless. Cloudflare’s network spans more than 200 cities, each capable of hosting a remote browser; this proximity keeps the round trip for a user’s input within milliseconds and delivers the responsive feel of local software. The actual threat surface—the parsing of external HTML, JavaScript, and the hundreds of Web APIs—is confined to a supervised container that can be discarded at the end of the session or at the first sign of compromise.

Completing the Cloudflare for Teams Stack

Browser Isolation builds on the Zero Trust framework already embodied by Cloudflare for Teams. That portfolio previously consisted of two services: Cloudflare Access, which gates access to internal applications without a legacy VPN, and Cloudflare Gateway, which enforces browsing policies against known-malicious sites. Both solve deliberate, visible risk: unauthorized traffic and users accessing dangerous known web addresses.

The next layer is protection against the unforeseeable, including zero-day exploits. In a remotely sandboxed session, any attempt to probe a browser vulnerability misfires inside a disposed container, nowhere near corporate endpoints or the data they hold. This approach directly addresses a long-standing remote computing problem: historically, the need for high-bandwidth streams or server-side page reconstruction made cloud-browser performance unacceptable, generating IT help-desk complaints rather than enterprise migration.

The vector-based streaming method turns those performance restraints into a question of bandwidth efficiency and display scale, rather than network latency. It finally allows the browser to be treated like other workloads in the cloud—placed where it can be managed, patched, and monitored centrally, and removed from devices where it has remained an uncontrolled and untrusted presence.

Those interested in early access can sign up via this form; additional users will be onboarded as the beta expands.