First Public Working Draft: Threat Model for the Web

Threat Model for the Web

https://www.w3.org/TR/2026/DNOTE-threat-model-web-20260526/

Published by
 Security Interest Group

Abstract

This document describes the Threat Model for the Web and include the Web Security Model and may include the goals that have not yet been achieved across the whole web platform, but which will still be applied in reviews of new and changed specifications.

Status of the Document

This section describes the status of this document at the time of its publication. A list of current W3C publications and the latest revision of this technical report can be found in the W3C standards and drafts index. 

This is a draft of the Threat Model for the Web. It is informative, not normative, and is not expected to become a W3C Recommendation. It describes a threat model and web security model that can inform reviews of new and changed web specifications. 

To comment, file an issue in the W3C threat-model-web GitHub repository. The Security Interest Group requests that public comments be filed as new issues, one issue per discrete comment. It is free to create a GitHub account to file issues. If filing issues in GitHub is not feasible, email public-security@w3.org (comment archive). In-progress updates can be viewed in the public editors’ draft. 

This document was published by the Security Interest Group as a Group Note Draft using the Note track. 

Group Note Drafts are not endorsed by W3C nor its Members. 

This is a draft document and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to cite this document as other than a work in progress. 

The W3C Patent Policy does not carry any licensing requirements or commitments on this document. 

This document is governed by the 18 August 2025 W3C Process Document.

-- 
This report was automatically generated using https://github.com/w3c/transition-notifier

Received on Tuesday, 26 May 2026 08:31:44 UTC