A decade ago, getting hacked usually meant something got onto your machine. You clicked a bad attachment, installed a shady program, and something ran in the background of Windows or macOS without your noticing. The operating system was the battleground. Antivirus lived there, updates patched it, and most of your risk sat somewhere on the C: drive.
That is not where you live anymore. Your email is a tab. Your bank is a tab. Your work documents, your calendar, your medical portal, your kid's school app, the smart lock on the front door, the login for your streaming service, and the password manager holding all of it. Tabs, tabs, tabs.
The browser is the operating system now, and attackers noticed years before most people did. In its 2026 browser threat report, Menlo Security reported that roughly one in five enterprise phishing attacks now slip past the security tools built to stop them, because the fight has moved into the browser session itself.
The Tab Bar Is the New Attack Surface
Think about what a modern browser session actually holds. Session cookies that keep you logged in for weeks. Saved cards. Autofilled addresses.
A password manager unlocked for the day. Half a dozen SaaS tools with standing access to your files. If an attacker gets a foothold inside that session, through a malicious extension, a lookalike domain, or a hijacked OAuth prompt, they do not need your password. They already have your seat.
That is the thread worth following through the rest of this piece: the browser is where your life is logged in, and the everyday habits that used to feel harmless are the ones deciding whether that session stays yours. A piece where Easier ran through the online habits worth fixing covers the basics well; the point here is to look at each habit through the lens of the tab bar, because that is where the damage now happens.
Password Reuse Is a Session Problem, Not a Login Problem
Reusing one password across sites used to feel like a login-screen issue. If the forum you signed up for in 2014 got breached, you'd change that one password and move on. Attackers now treat those old dumps as a starter kit. They spray the credentials at every consumer service they can think of and let automation find the matches.
What comes next is the part people miss. Once one account opens, the attacker uses the browser session to pivot: resetting other logins from the compromised email, reading your password manager's recovery options, checking which SaaS tools trust that email for single sign-on. NIST's current authentication guidance, SP 800-63B, tells verifiers to make multi-factor authentication available and encourage its use for exactly this reason. A unique password per account, kept in a manager, plus MFA on anything tied to money, email, or identity, closes off most of the pivot.
Oversharing Feeds the Password-Reset Screen
The old worry about oversharing was strangers. Someone sees a vacation post, robs the empty house. That still happens, but the more common damage in 2026 goes unnoticed. Attackers scrape your public posts for the exact material a password-reset flow asks for: your dog's name, your first school, the street you grew up on, your mother's maiden name buried in a Mother's Day tribute.
You don't have to disappear from the internet. You do have to stop treating security questions as if they were secret. Answer them with nonsense strings stored in your password manager.
Lock down the audience on personal posts. Assume anything you put in a public bio can and will be typed into a reset form by someone who is not you.
Unpatched Devices Are Unpatched Browsers
"I'll update it later" is the most expensive sentence in personal security. On a modern device, most of what needs patching is the browser and the things it talks to: the OS keychain, the WebView your banking app uses, the router still running firmware from 2021. Delay a browser update for a few weeks and you are running a version with publicly documented ways to escape a tab.
Extensions Are the Trojan Horse Nobody Audits
Extensions deserve their own beat because they sit inside the session with almost no supervision. A compromised or malicious extension can push a silent update, read the DOM of every tab, and ship your data, including the chat history from whatever AI tool you use, to a server you'll never see. OWASP's extension vulnerabilities cheat sheet walks through the mechanics in plain terms, and the picture is not reassuring.
Treat your extension list the way you'd treat the apps on a work laptop. Keep the ones you actively use. Remove the rest. When something asks for permission to read and change data on all websites, that is exactly what it will do, forever, until you stop it.
The Small Changes That Remove Most of the Risk
None of this requires a security overhaul weekend. It requires a short list of habits, repeated, that shrink the surface an attacker has to work with.
The browser is where your life is logged in. Guard that session the way you'd guard a set of house keys, and most of the everyday risk goes with it.