This feature actively controls users' ability to open Developer Tools or manually load browser extensions in "Developer Mode" via "load unpack". It can also assist with preventing users from running unauthorized JavaScript code in the Developer Tools console.

Native Messaging Hosts allows the software installed on the device to communicate with Prisma Browser and its installed extensions, and vice versa. Enterprise software that interacts with the browser typically requires you to select "Allow only hosts installed with admin permissions."

This policy allows you to determine if keylogging protection will be enabled. Keylogging tools can monitor and report a user's actions as they interact with the computer. As the name suggests, a keylogger records what the user types, and reports the information back to whoever installed the logger.

The Browser self-protection control enhances the security of Prisma Browser in high-risk environments, particularly on unmanaged or contractor devices (BYOD). These devices often grant users administrative privileges, increasing exposure to insider threats and malware.

For additional background information, refer to Prisma Browser Self-Protection for Windows.

To mitigate these risks, Prisma Browser introduces an advanced runtime protection mechanism based on a Windows kernel-level driver. This ensures the browser process remains protected from tampering and unauthorized interference during operation.

You can remotely enable or disable this driver-based protection. This control is disabled by default, and applied only when Prisma Browser is installed with Administrative privileges on Windows, and the user is running the browser as Administrator.

With this feature, you can control the display of popups in the browser.

The popups can be allowed, allowed with exceptions, blocked, or blocked with exceptions.

You can use this feature to control notifications being displayed within the browser. The notifications can be allowed, allowed with exceptions, blocked, or blocked with exceptions.

The Authentication Factor is used to configure the authentication method used by the Prisma Access Browser to trigger authentication for step-up MFA authentication, browser lockscreen and unlocking the password manager. A single authentication factor is used for all actions.

The Authentication factor is triggered by one of the following actions (if configured):

• Web access > Require MFA
• Login controls . Login Form > MFA
• Data controls > Data Leak Prevention > File Download > Prompt > Require MFA
• Data controls > Data Leak Prevention > File Upload > Prompt > Require MFA
• Browser Security > Browser Session > Browser Lock

Stops zero-day WebAssembly attacks in real time by monitoring in-browser memory behavior and terminating malicious execution before any impact occurs.

This feature strengthens Prisma Browser’s isolation from the underlying host device, significantly mitigating the risk of cookie hijacking via malware or physical access. Once enabled, cookies are encrypted both at-rest (on-disk) and in-memory, protecting against memory dump exploits and unauthorized access via Developer Tools.

Choose whether end users can end browser processes via the browser task manager.

While most of the time we want to keep the Prisma Browser as a secure bubble, that all work is done only in the browser. This is not possible for a few reasons. First of all, some applications can't be opened in a browser, such as Zoom, Teams, Slack, among others. Blocking these apps would result in a terrible user experience. Second, most mobile devices are BYOD. Third, Some URLs can only be opened in a native app.