Chromium zero-day underscores the limits of endpoint patching

On March 25, 2022, Google pushed an emergency update for Chromium-based browsers to address CVE-2022-1096, a high severity flaw. Details remain under wraps while users get patched. The immediate advice stands: update your local browser. But that reactive measure only closes a door after the threat has been wandering the hall.

Cloudflare takes a different position with its Zero Trust platform. Instead of relying on endpoints being current, it assumes they may be vulnerable and shifts the execution of untrusted web code off-device entirely.

Layered defense for untrusted web traffic

Cloudflare Zero Trust does not bet on a single control. Browser-based attacks are handled through a three-stage pipeline:

  1. The roaming client sends Internet-bound traffic over an encrypted tunnel to the nearest Cloudflare data center.
  2. The secure web gateway inspects that traffic, applying network intelligence, antivirus scanning, and threat feeds. Requests to known-bad destinations are dropped; anything high-risk or unrecognized is routed to a remote browser.
  3. Browser isolation executes all website code in a remote environment, so the user's device never touches the untrusted payload.

That means an unpatched browser is not the last line of defense—it is an output device.

Isolation as protection from the unknown

Zero-day exploits frequently arrive through email links, support tickets, or other external messages before anyone knows they exist. The risk cannot be eliminated, but remote browser isolation shrinks the attack surface drastically:

  • The endpoint receives only a thin HTML5 remoting shell and vector draw commands, never the underlying web code. A compromised page cannot reach the device.
  • Remote browsers are destroyed and rebuilt to a clean state at the end of every session, so an exploited instance does not persist.
  • Egress traffic from remote browsers is encrypted, browsers are segmented from one another via virtualization, and instances are spread across physical hardware on Cloudflare's global network. A breach in one cannot spill into its neighbors.
  • All remote egress traffic is logged in the secure web gateway, giving SIRT teams visibility into what isolated sessions actually did.

Patching remote browsers is not like patching endpoints

None of those controls remove the need to patch. What they change is who carries the burden and how fast it happens.

Updating a workforce's local browsers means interrupting people, either by asking them to stop work or by forcing a restart through MDM. Both approaches are slow, disruptive, and uneven in coverage. Remote browsers running on Cloudflare's network are updated without user or administrator action. Once a patch is applied, any traffic destined for an isolated site is served by a fresh, patched browser instance—no restart required on the user's side.

The frequency of these events makes the operational difference meaningful. Chromium saw over 300 recorded vulnerabilities in 2021 and more than 40 in the first months of 2022, according to cvedetails.com. Administering that cadence through endpoint updates alone is a losing game.

Cloudflare Browser Isolation is available to both self-serve and enterprise customers. Those interested can request a demo of Clientless Web Isolation from the product page.