@@ -145,6 +145,18 @@ For the purposes of the present document, the terms given in Regulation (EU) 202
<mark>Editor's Note: Proposal to put together a common term sheet for all verticals developed in CYBER-EUSR.</mark>
browser profiles: private browsing sessions, temporary guest profiles or user managed profiles that may be used for separating principals or use-cases
effective Top-Level Domain: a domain suffix, under which independent tenants may register subdomains
public suffix list: list of all eTLDs
registrable domain: subdomain exactly one level below an eTLD, such that the domain and all further sub-domains are registered to a single tenant
site: logical security boundary defined by scheme and registrable domain
third-party cookies: cookies keyed to a site other than the top-level site
Origin: An origin in browser products is the compound of the scheme, host and port of a web resource. When a web resource defined as valid in the user documentation cannot be formed into a meaningful combination of host, scheme and port, the product constructs a synthetic origin uniquely identifying the resource.
Same-origin policy: A security model in browser products used to determine whether assets and state should be shared or not between web page execution contexts.
@@ -171,6 +183,7 @@ For the purposes of the present document, the [following] abbreviations [given i
`CRA Cyber Resilience Act`
`CVE Common Vulnerabilities and Exposures`
`DB Database`
`eTLD Effective Top-level Domain`
`EDR Endpoint Detection and Response`
`DHCP Dynamic Host Configuration Protocol`
`GDPR General Data Protection Regulation`
@@ -304,6 +317,7 @@ Almost all computer users interact with web browsers at some point. This include
- Professionals in all fields of work
- Workers in critical infrastructure
- Users with accessibility needs
## 4.6 Use Cases
### 4.6.1 Standalone browser use cases
@@ -427,6 +441,10 @@ Applicability: Web browsers which maintain their own root store, rather than usi
**[REQ-EXT-SU-1]**: The product shall support automatic updates of extensions, and before installing an update shall cryptographically verify the update.
**[REQ-STORE-SU-1]** The product shall maintain the validity of data stored to disk across updates.
**[REQ-STORE-SU-2]** The product shall update the Public Suffix List regularly.
## 5.5 Authentication and access control
Proposed ESR code: AAC
@@ -447,6 +465,10 @@ Example: Permissions divided such that an extension can request and access the m
**[REQ-EXT-AAC-6]**: The product shall ensure isolation between the execution and data contexts of different extensions.
**[REQ-STORE-ACC-1]** The product shall store data and enforce access according to the Same Origin Policy.
**[REQ-STORE-ACC-2]** The product shall not share or make data available across browser profiles.
**[REQ-SOP-AAC-1]**: The product shall deny access in one origin to all parts of another origin, except as defined in the user documentation.
Example: Web pages may load images from other origins, message using `window.postMessage` and may access limited properties such as `Location`. Web pages may not access the document object model or global Window scope from scripts of other origins. The user documentation references industry standards with implementation recommendations and additinal examples.
@@ -485,6 +507,15 @@ Example: Implementation of HSTS [i.8], active mixed content blocking [i.9], and
**[REQ-EXT-CON-1]**: The product shall prevent secrets stored by extensions from being read by other extensions or by web content.
**[REQ-STORE-CON-1]** The product shall not send third-party cookies by default. They may be supported consistent with the `Partitioned` attribute.
NOTE: The product can provide users the ability to share third-party cookies, whether on a case-by-case basis through interaction as in Storage Access API or throughout their browser profile through configuration.
**[REQ-STORE-CON-2]** The product shall make use of OS access control, encryption methods or other mechanisms to ensure confidentiality of disk-stored data.
**[REQ-STORE-CON-3]** The product shall store browser cache data such that they are keyed to both top-level site and resource.
**[REQ-SOP-CON-1]**: The product shall only allow scripts to access the body of a cross-origin HTTP response where the source origin has opted to allow access by the requesting origin.
Example: Implementation of Cross-Origin Resource Sharing (CORS)
@@ -528,6 +559,8 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
<mark>Editor's note: Need conclusion wrt this being about page state such as scroll position, form data or storage or unspecific or more specific.</mark>
**[REQ-STORE-AVA-1]** The product shall retain data stored to disk in case of a crash and make it available upon browser restart.
## 5.10 Impact Minimisation
Proposed ESR code: IM
@@ -605,6 +638,8 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
**[REQ-EXT-LOG-1]**: The product shall provide the user the ability to identify running extensions, and to observe their activity.
**[REQ-STORE-LOG-1]** The product shall provide an interface for viewing information about stored data at a granularity of site or narrower (e.g., origin).
## 5.14 Data Removal and Transparency
Proposed ESR code: DRT
@@ -616,6 +651,12 @@ Applicability: Web browsers which allow changing TLS-related settings.
**[REQ-EXT-DRT-1]**: The product shall enable the removal of individual extensions, which shall delete all data associated with the extension, and revoke all permissions granted to it.
**[REQ-STORE-DRT-1]** The product shall ensure when storage data is deleted, it uses appropriate APIs that ensure the data is deleted from the underlying storage device.
**[REQ-STORE-DRT-2]** The product shall provide reset functionality that removes all stored data across all sites and browser profiles.
**[REQ-STORE-DRT-3]** The product shall have an interface for deleting storage at a granularity of site or narrower (e.g., origin).
## 5.15 Vulnerability Handling
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 2.
