A browser-to-shell transition happens when user activity in a web browser leads directly to a command-line tool such as PowerShell or cmd.exe. In practice, this often means a web page, prompt, or fake verification screen has persuaded the user to press Win+R, paste a command, or open a shell and execute instructions.
This matters because browsers are expected to render content, not launch system commands. Once the action crosses into a shell, the attacker can run scripts, download malware, steal browser data, or change system settings. Security teams treat this as a strong warning sign in ClickFix-style attacks and other social-engineering campaigns. Defenders watch for unusual parent-child process chains, browser activity followed by PowerShell, and web pages that instruct users to execute commands. Blocking or alerting on browser-initiated shell launches can help stop the attack at the handoff point.