Browsers and Password Managers Under the CRA (EN 304 617 & 618)

Web browsers (EN 304 617) and password managers (EN 304 618) are classified as Important Class I products — reflecting their critical role in user security. Both handle sensitive data and are high-value targets for attackers.

Browser Requirements (EN 304 617)

• Automatic updates — Security patches delivered automatically; browsers already do this well
• Sandbox architecture — Process isolation for tabs and extensions
• Certificate validation — Proper TLS certificate chain verification
• Extension security — Review process for browser extensions; ability to disable/remove malicious extensions
• Privacy defaults — Tracking protection enabled by default
• Phishing/malware protection — Built-in Safe Browsing or equivalent

Password Manager Requirements (EN 304 618)

• Zero-knowledge architecture — Vendor cannot access stored passwords
• Strong encryption — AES-256 or equivalent for vault encryption
• Master password strength enforcement — Minimum complexity requirements
• Breach monitoring — Check stored credentials against known breaches
• Secure sharing — End-to-end encrypted password sharing
• Multi-factor authentication — Support for MFA on vault access

Market Impact

Most major browsers and password managers already meet many of these requirements. The CRA formalizes these as legal obligations and adds documentation, vulnerability handling, and conformity assessment overhead. Smaller vendors may struggle with the compliance burden.