Browser-side staging is a delivery technique where an attacker prepares or assembles parts of a payload inside the victim’s browser instead of sending a complete malicious file upfront. The browser may decode data, rebuild an archive, fetch follow-on components, or transform an attachment into something executable or more useful to the attacker.
This matters because it shifts part of the attack chain into a trusted application layer. Traditional defenses that focus on file extensions, mail gateway scanning, or static attachment analysis can miss what happens only after rendering. In real attacks, browser-side staging can appear in HTML, SVG, or other web-native content that triggers script execution or client-side reconstruction. Defenders look for unusual script activity, suspicious downloads, archive creation, and post-open process behavior. Limiting active content, tightening preview behavior, and inspecting rendered files helps reduce this risk.