@@ -380,6 +380,12 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
> NOTE: It is proposed that a cross-vertical task force could work on the technical requirements to be included in this clause.
**[REQ-MEM-KEV-1]**: Web browser interfaces that are, or could potentially be, exposed to untrusted data shall undergo automated dynamic analysis to identify vulnerabilities (for example, via techniques such as fuzzing in an environment that enables the detection of memory access errors).
**[REQ-MEM-KEV-2]** The web browser source code shall undergo automated static analysis to identify vulnerabilities (for example, via LLM code analysis).
**[REQ-MEM-KEV-3]** The web browser source code shall make use of languages, language features, libraries, and/or automation-enforced coding conventions that prevent well-known classes of vulnerability from being introduced (for example, via the use of memory safe languages, bounds checked container classes, restricting use of raw pointers).
## 5.3 Secure by default configuration
Proposed ESR code SBD
@@ -560,6 +566,10 @@ Example: Extensions may bundle assets in their packages, and browsers may allow
Example: Usage of cross-origin options such as `X-Frame-Options` or `Cross-Origin-Resource-Policy` allow source origins to specify usage constraints for products to receive and enforce.
**[REQ-MEM-MAS-1]** The web browser shall not include unneeded functionality that is, or could potentially be, exposed to untrusted data (for example, shall not expose code implementing an unused file format).
**[REQ-MEM-MAS-2]** The web browser shall validate or otherwise render harmless untrusted data before exposing it to complex parsing functionality implemented in a non-memory safe language, or in a privileged process.
## 5.12 Exploitation Mitigation Mechanisms
Proposed ESR code: EMM
@@ -576,6 +586,16 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
**[REQ-ISO-EMM-3]**: The product shall reduce the privileges of its various components with respect to the operating system to the level required to perform their tasks.
**[REQ-MEM-EMM-1]** The web browser shall include assertions to the correctness of program state, which fail safely (for example, an unexploitable crash) when violated (for example, via the use of ASSERT() or CHECK() statements).
**[REQ-MEM-EMM-1]** Portions of the web browser that are not implemented in a memory safe language shall employ mitigations to reduce exploitability of memory safety vulnerabilities (for example, via compiler flags, hardened allocators).
**[REQ-MEM-EMM-1]** The web browser should make use of mitigation technologies provided by the operating system and/or hardware when appropriate (for example, hardware-assisted memory tagging, ASLR).
**[REQ-MEM-EMM-1]** Web browser processes should only have access to a restricted set of operating system capabilities and privileges as required by their function (e.g. via sandboxing, system call filtering)
<mark>Editor's note: Should sandboxing generally be considered by memory safety, or isolation?</mark>
