Runtime-generated content is web content assembled when the browser runs it, rather than served as a fixed public page. Scripts can build the interface from data, templates, or local browser objects, so the visible page may exist only inside that session.
This matters in cyber security because defenders often rely on scanning, reputation checks, and blocklists tied to stable URLs. If a phishing login form is created at runtime, there may be no long-lived page to crawl or categorize before the victim interacts with it. Attackers can use this to make credential theft harder to spot, while defenders may need to monitor browser behavior, suspicious form rendering, blob: or other object-URL activity, and unusual credential submission flows. In practice, the strongest mitigations are endpoint telemetry, identity protections, and phishing-resistant MFA that limits the value of stolen passwords.