Browser powered scanning in Burp Suite

Summary: PortSwigger integrated Chromium into Burp Suite Professional's scanner starting with version 2020.8.1, controlling the browser remotely via the DevTools protocol rather than embedding it, so that browser crashes would not crash Burp and security patches could ship the same day. The change addresses modern web applications where the main HTML document is a container that JavaScript populates, which older crawlers treated as a dead-end because they parsed raw responses instead of executing scripts.
Why it matters: If your scanner only parses server responses, it sees a fraction of the attack surface on JavaScript-built applications - the API calls and client-side code where the real exposure now lives never get mapped.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026