A browser exploit window is the time between a vendor’s patch release and the moment most endpoints have actually installed it. During that gap, devices still running the old browser build remain targetable by known vulnerabilities, even though a fix exists. Because browsers process untrusted web content continuously, attackers often scan for outdated versions and deliver exploit code through malicious pages, ads, or redirected resources.
This window matters because browser bugs can enable code execution, sandbox escape, or credential theft with little user interaction. Defenders try to shrink it with auto-update, forced restart policies, inventorying browser versions, and blocking access from noncompliant devices. The shorter the exploit window, the less time attackers have to weaponize a publicly known flaw across a fleet.