Closing the Browser Security Gap at the Network Edge
Security teams defending corporate networks often juggle a patchwork of firewalls, DNS filters, DLP tools, and sandboxing appliances. Adding another layer—like Remote Browser Isolation—usually means a complex integration project that burdens already stretched administrators.
Cloudflare is now simplifying that process by making Browser Isolation available to networks connected via its Magic WAN service. This allows organizations to protect internet-bound traffic from browser-borne malware and zero-day exploits without deploying endpoint software or relying on users to keep their browsers patched.
This integration hinges on treating the browser as the primary attack vector. Modern browsers are no longer simple document viewers; they execute untrusted code from servers worldwide. In 2022 alone, Chromium—the engine behind over 70% of web traffic and a frequent handler of sensitive email and internal app data—saw six disclosed zero-day vulnerabilities. Patching typically falls to end-users, who delay updates to avoid restarting their browsers.
Browser Isolation addresses this by executing all website code remotely in a sandboxed container. If malicious code triggers, it runs far from the user's device and network, neutralizing the threat.
How the Integration Works
The new capability lets Magic WAN customers apply Browser Isolation through standard HTTP policies, extending protection to traffic from on-premise networks via IPsec, GRE, or private network connections.
Step 1: Connect and Enable Gateway
Administrators first connect their network to Cloudflare over IPsec, GRE, or Magic WAN's private network connectivity options. Setup steps vary by hardware vendor, with detailed guidance in the developer documentation.
Step 2: Create an Isolation Policy
Isolation policies for Magic WAN traffic operate identically to those used with the WARP roaming client. Create a new HTTP policy with the Isolate action under Cloudflare Zero Trust → Gateway → HTTP Policies. Further policy details are in the developer docs. Previously, such traffic would hit a block page.
Step 3: Enable Non-Identity On-Ramp
For Magic WAN traffic to bypass the block page and reach the isolation service, administrators must toggle the Non-identity on-ramp support setting under Cloudflare Zero Trust → Settings → Browser Isolation. This step is mandatory for both new and existing customers.
Under the Hood
Once configured, matching traffic is transparently intercepted and rendered through a remote browser located at the nearest Cloudflare data center. This proximity keeps latency minimal, preserving end-user experience while isolating the network from web-based threats.
Cloudflare also offers a demo landing page for testing the remote browsing experience before committing to a full rollout.
Future iterations will extend Browser Isolation to additional on-ramps, including Proxy PAC file deployment and inline protection for self-hosted Access applications.
