Browser-powered scanning for Burp Suite DAST - Port Swigger

Summary: PortSwigger's browser-powered scanning makes Burp Scanner use Burp's browser for all navigation during both the crawl and audit phases, letting it execute JavaScript to render dynamically generated UIs and trigger event handlers that modify requests on the fly. With the default scan configuration, Burp Scanner checks the machine's specs and uses Burp's browser for all scans if they meet the system requirements, otherwise reverting to the previous crawler engine; the setting sits under Crawling > Discovery logic > Use Burp's browser for crawl and audit.
Key Takeaway: The previous crawler engine could not render JavaScript-built navigation and might miss key vulnerabilities as a result, so any scan still falling back to it is testing a smaller surface than the site actually exposes. On Linux, a chrome-sandbox ownership fix must be reapplied with each Burp Scanner update that ships a new Chromium version, a maintenance trap for teams running auto-updates.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026